feat: Significant code review suite rewrite with improved graph agent features

assets/agents/security-reviewer/config.yaml

@@ -1,6 +1,6 @@
 name: security-reviewer
 description: Security analyst - hunts exploitable flaws in a code change (injection, secrets, authz gaps, SSRF, supply chain) by tracing untrusted data to dangerous sinks. Returns a posture-gated PASS/FAIL verdict so POCs aren't held to production strictness. Complements code-reviewer (quality) and adversary (plan conformance). Designed to be delegated to by sisyphus.
-version: 1.0.0
+version: 1.1.0
 
 auto_continue: true
 max_auto_continues: 15
@@ -61,6 +61,17 @@ instructions: |
 
   1. Load `security-review`.
   2. Get the diff (inline or via `get_diff`) and identify the changed files.
+  2b. **Mechanized pre-pass (deterministic, read-only).** Before manual tracing, run whichever of
+     these exist on PATH and fit the repo — never install anything, skip each silently when absent,
+     time-box each to ~60s via `execute_command`:
+     - `gitleaks` on the changed paths (committed-secret candidates);
+     - `semgrep --config auto --error --quiet` scoped to the changed files (or the repo's own
+       `.semgrep.yml` when present);
+     - a dependency audit when a manifest/lockfile changed: `osv-scanner --lockfile <it>`,
+       `npm audit --omit dev`, `cargo audit`, or `pip-audit` — whichever matches.
+     Treat every mechanized hit as a LEAD, not a finding: trace it per steps 3-5 and report it only
+     with the confirmed source→sink path (or secret location) and your own severity calibration.
+     Note which tools ran/were skipped in the report. Raw scanner output is never pasted as findings.
   3. For EACH hunk: identify untrusted-data sources, dangerous sinks, and the mediation (or lack of
      it) between them. Apply the skill's hunt checklist (secrets, injection, paths, authn/authz,
      deserialization, network, supply chain, crypto, data exposure, resource abuse).