Update AutoReview skill snapshot

[iancleary]

Summary

• Refresh the Forge-managed autoreview skill and helper scripts from openclaw/agent-skills commit 66cf3dfbf560e7a93b6525b0cd2c26d012099ad6.
• Add pinned upstream provenance to config/release-skills.toml for autoreview.
• Add forge skills validate --check-upstream so Forge can fetch the configured GitHub tree and report whether the pinned upstream hash is still current.

Fixes #109.

Verification

• cargo run -p forge -- skills validate autoreview --source repo --repo-path /home/iancleary/.openclaw/workspace/forge --check-upstream
• cargo run -p forge -- skills validate --all --source repo --repo-path /home/iancleary/.openclaw/workspace/forge
• cargo test -p forge release_skill_contract
• cargo test -p forge parse_github_tree_url_requires_pinned_commit
• cargo test -p forge embedded_release_skills
• cargo test -p forge embedded_release_skill_frontmatter_names_match_release_names
• cargo check
• cargo test -p forge
• PYTHONDONTWRITEBYTECODE=1 python3 .agents/skills/autoreview/scripts/autoreview_test.py

Review Note

Attempted the requested Sol review:

.agents/skills/autoreview/scripts/autoreview --mode local --engine codex --model codex=gpt-5.6-sol --thinking codex=medium --max-priority P0

The refreshed helper now fails closed unless trufflehog is installed, and this environment does not currently have it:

TruffleHog is required but was not found.