Review bot

Publishing skills can post reviews as a GitHub App, so a pull request's author is not reviewing their own work. This skill is the mechanism behind that: it holds the script that mints the app's short-lived installation token and reports the app's identity. The app itself is declared per repository, its private key is held per machine, and nothing here reads a config file or infers a repository from a remote.

The Reviewing identity block

A repository declares its reviewing app in docs/agents/issue-tracker.md, in exactly this block, which every publishing skill reads:

## Reviewing identity

- **Reviewing app**: <app name>
- **Client id**: <client id>

An optional third field, Review-token command, holds a literal shell command for a repository whose token comes from somewhere else (a bot account's PAT from a secret store, for instance). When it is present, the publisher uses it as-is and does not consult this skill.

Where the key lives