feat: single-source prompt generation, tightened prompts, drift guard

[rlorenzo]

Summary

Makes .claude/commands/*.md the canonical prompt sources and adds tools/generate, which derives the Codex/Copilot/Antigravity SKILL.md files and the shared review-loop prompts from them. Also applies a round of prompt improvements (all token-neutral or token-saving) and closes several documentation/config gaps found in a repo review.

Generator and drift guard

• tools/generate regenerates all derived files; tools/generate --check verifies they are in sync and lists stale files.
• New pre-commit hook (generated-files-in-sync) runs the check locally and in CI; test/generate.bats adds five tests covering sync, drift detection, regeneration, and missing-description validation.
• The two intentional per-tool wording drifts were normalized so generation is a pure frontmatter swap: review-pr now says "re-run this command" (tool-neutral), and the decorative --- rules were dropped from dependency-review.

Prompt improvements

• code-review: define High/Medium/Low severities and what makes a Low finding a blocker (removes the loop's main convergence ambiguity); define iteration N — bin/code-review-loop now injects the number on initial and follow-up passes; scope OWASP mapping to security findings; replace the mixed apply_patch/diff example with a plain unified diff.
• code-review-followup / plan-review-followup: restate the read-only and scope guardrails that were previously lost on follow-up passes (these prompts are sent standalone by the loop scripts).
• code-review-response: cut ~40% of prose aimed at human readers; decision criteria and ✅/📝/❌ response markers unchanged.
• plan-review: allow NO_FURTHER_FEEDBACK on the first pass so an already-clean plan skips a full editor + re-review cycle (the loop already checks the sentinel before cycle 1, so no script change was needed).
• code-refinement: say how to discover the lint command and that missing tests should be added, not just identified.
• commitmsg: git diff --staged --stat first, full diff only where intent is unclear.
• dependency-review: prefer CLI/API lookups (npm view, gh api, OSV) over web browsing, make community signals best-effort with an explicit SKIPPED status instead of inviting invented results, trim rationale prose.
• efficient-orchestration: concrete pause/resume fallback (write a handoff file and stop — never busy-wait) when the harness has no scheduled-wakeup primitive.
• All Claude commands: YAML frontmatter with description (surfaced by /help and setup), plus allowed-tools for commitmsg and argument-hint for review-pr.

Other fixes

• Document /dependency-review in the README (it shipped in all four tool directories but was missing from Available Commands).
• Gitignore the review-loop output files in this repo and recommend the same snippet for target projects in the README.
• Update README "How It Works" / "Adding New Commands" / Contributing for the author-once-generate workflow.

Testing

• test/run: 46/46 BATS tests pass (including the new generate.bats).
• shellcheck -x clean on tools/generate and all changed scripts.
• markdownlint-cli2 clean on all 28 markdown files.
• tools/generate --check passes on the committed tree.

Note for reviewers

The generated skills include changes their old copies didn't have (e.g. review-pr's intro line), so the first ./setup run after merging will report those commands as updated — expected.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Rk6ven8xHh8qdBMV7RqYWZ

---

Generated by Claude Code