feat(review): codex on-disk skill discovery in $name form

Codex's DiscoverReviewSkills was a Phase-1 stub returning nil, while spawn-time validation (VerifyConfiguredSkillsInstalled) rejects any configured skill that is neither a curated builtin nor discovered — so every on-disk codex skill configured in $name form hard-failed with 'configured review skill(s) not installed'. This repo's own saved $code-reviewer config hit it on every run.

Ports the discovery slice from closed #1370 (applies verbatim — the touched files did not diverge and no open PR overlaps them):

• skilldiscovery gains the generic SKILL.md scanners (skills dir, versioned plugin cache with semver pick, frontmatter parse, dedupe) parameterized by invocation form (SlashForm/DollarForm).
• claude-code's discovery delegates to the shared scanners; its own discovery tests pass unchanged, pinning identical behavior.
• codex discovers ~/.codex/{skills,plugins/cache,superpowers} in $name / $plugin:name form — the literal token codex's skill system resolves.
• codex's curated '/review' builtin is removed: the interactive TUI slash command never fires through codex exec, so validating it was a lie. Configs still naming '/review' for codex now fail validation with the reconfigure hint (honest — that path never invoked a real skill); on-disk skills like $code-reviewer validate and run.

Verified against the real ~/.codex on this machine: $code-reviewer, $review-swarm, $superpowers:* et al discovered correctly.