feat: add gh_bot_review tool to parse AI bot review findings

[four-bytes-robby]

Purpose

Add a gh_bot_review supertool that reads AI bot review comments on a PR (coderabbitai, cubic-dev-ai) and extracts structured, actionable findings. Solves the "bot replies → agent checks → bot replies again" interaction cycle.

Spec

• Tool name: gh_bot_review
• File: src/tools/gh-bot-review.ts
• Export: ghBotReviewTool
• Registration key: gh_bot_review

Args

• pr (number, required): PR number to check
• repo (string, optional): Repo in owner/repo format (default: current repo)

Behavior

1. Fetch all reviews + comments on the PR via gh api
2. Filter to bot authors: coderabbitai[bot], cubic-dev-ai[bot], dependabot[bot]
3. Parse structured prompts in bot comments:
   • coderabbitai format: "Prompt for AI agents" / "Prompt for all review comments" blocks containing "Verify each finding... In @file at line N: description"
   • cubic-dev-ai format: "Prompt for AI agents (unresolved issues)" with <violation> tags containing <file>, <violation number="N" location="file:line">, P1/P2 severity
   • dependabot format: PR title/body summarizing the dependency bump
4. Return structured output:

[
  {
    "bot": "coderabbitai",
    "type": "peer_dependency|security|nitpick|bug|dependency",
    "severity": "P1|P2|nitpick|info",
    "file": "package.json",
    "line": 35,
    "description": "...",
    "suggestion": "...",
    "actionable": true
  }
]

5. For bot comments without structured prompts (e.g., review-in-progress, finishing touches), return them as type: "meta" with actionable: false

Test

• tests/gh-bot-review.test.ts with fixtures from real PRs:
  • PR feat/14 append file tool #15: cubic-dev-ai P1+P2 findings + coderabbitai finishing touches
  • PR chore(deps-dev): bump @eslint/js from 9.39.4 to 10.0.1 #5: coderabbitai peer-dep mismatch
  • PR chore(deps): bump googleapis/release-please-action from 4 to 5 #2: coderabbitai nitpick (pin action to commit hash)

Pattern References

coderabbitai prompt:

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `<EMAIL>`:
- Line 35: The `@eslint/js` dependency at version 10.0.1 requires eslint ^10.0.0...

cubic-dev-ai prompt:

<file name="src/tools/append-file.ts">
<violation number="1" location="src/tools/append-file.ts:48">
P1: after_line: -1 is placed at the wrong position in prepend mode...
</violation>
</file>