fix(code-review): reject resolve-base.sh against repo top-level, not CWD

[davidalee]

Summary

Follow-up to #11 / EveryInc#783. Codex review on EveryInc#783 flagged that the CWD-rejection guard for ${CLAUDE_SKILL_DIR}/scripts/resolve-base.sh compares real_base against pwd -P — the caller's current directory — not the reviewed-repo top-level. The bypass:

• Reviewer is launched from a monorepo subdirectory: pwd -P = <repo-root>/services/foo.
• Harness sets ${CLAUDE_SKILL_DIR} to <repo-root>/.evil (a sibling of the subdir).
• real_base is outside the CWD subdir, so the case clause does not match and the path is accepted.
• bash \"$RESOLVE_SCRIPT\" then executes a repo-controlled script.

The valid (and intended) boundary is the reviewed repo's top-level, not the caller's CWD.

What changed

• Both probe blocks (branch and standalone modes) now derive real_repo from git rev-parse --show-toplevel, with a pwd -P fallback when the CWD is not inside a git repo. The case match rejects real_base equal to or nested under real_repo.
• Contract test pins the new shape (git rev-parse --show-toplevel must appear in SKILL.md) and adds an end-to-end monorepo-subdirectory attack scenario: git init a fake repo, set CWD to a subdir, point CLAUDE_SKILL_DIR at <root>/.evil, assert the probe fails closed and the decoy never runs.

Verification

• bun test tests/review-skill-contract.test.ts — 26 pass.
• bun test — full suite (1240 tests) passes.
• bun run release:validate — clean.

Test plan

• Existing scenarios (unset, empty, happy-path, hostile-CWD-nested-skill-dir) still pass.
• New monorepo-subdir scenario: rejected, fail-closed, decoy not executed.