fix(review): pass codex skills natively instead of paraphrasing them

expandCodexBuiltinReview silently REPLACED a configured /review skill with a generic 28-word instruction before composing the prompt — the configured skill never ran. This is the codex sibling of the claude -p slash-expansion bug: in both cases the child executed something other than what the user configured.

Rewrite slash-form skill invocations (the agent-portable form profiles are configured with) into codex's native $name form, which codex's skill system resolves against its installed-skill catalog and loads the matching SKILL.md. Non-slash entries (plain instruction text) pass verbatim; PromptOverride is untouched.

Extracted from PR #1370 (codex review correctness), which is closed in favor of this narrower fix: its live-token tailing remains queued as a separate follow-up, its per-spawn reasoning_effort was dropped by product decision (entire does not alter how skills run), and its skilldiscovery refactor is superseded.