feat: add code-review-checklist skill for code review guidance

Adds a structured review checklist specific to the freebuff codebase.
Covers correctness, TypeScript conventions, security, testing,
freebuff-specific invariants, and key files to watch.

This is a single skill (not the three-skill bundle from the original
PR #903) and references actual repo conventions from AGENTS.md.

Author: Dataflow Dev

common/src/templates/initial-agents-dir/skills/code-review-checklist/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: code-review-checklist
+description: Structured checklist for reviewing code changes in the freebuff codebase. Covers correctness, conventions, security, and testing.
+license: MIT
+metadata:
+  category: development
+  audience: developers
+---
+
+# Code Review Checklist
+
+Use this checklist when reviewing pull requests or evaluating code changes in the freebuff repository.
+
+## 1. Correctness
+
+- [ ] Does the change do what the PR description claims?
+- [ ] Are edge cases handled (empty inputs, null values, error paths)?
+- [ ] Are async operations properly awaited or error-handled?
+- [ ] Does the change break any existing behavior (check for unintended side effects)?
+
+## 2. TypeScript & Code Style
+
+- [ ] No `any` types — use proper typing or generics
+- [ ] Imports follow existing patterns (e.g., `./utils/auth` vs `./utils/config-dir` — check for import cycles)
+- [ ] No circular dependencies (especially in `cli/src/` — `project-files → auth → logger → project-files` is a known cycle)
+- [ ] Functions are exported only if used outside their module
+- [ ] Error messages are descriptive and actionable
+
+## 3. Conventions (from AGENTS.md)
+
+- [ ] Uses `bun` runtime and package manager (not npm/yarn)
+- [ ] Dependency injection used over module mocking in tests
+- [ ] Interactive CLI tests run in tmux (not headless)
+- [ ] No force-pushes to `main`
+- [ ] Monorepo boundaries respected (`cli/`, `sdk/`, `common/`, `agents/`, `packages/`)
+
+## 4. Security
+
+- [ ] No secrets, API keys, or tokens committed (even in test fixtures)
+- [ ] User input is validated before use (especially from `credentials.json`)
+- [ ] Auth tokens are not logged or exposed in error messages
+- [ ] File operations use safe paths (no unescaped user input in `path.join`)
+
+## 5. Testing
+
+- [ ] New code has corresponding tests
+- [ ] Tests use `bun:test` (not jest/vitest)
+- [ ] Mocked modules don't leak state across test files (bun mocks are process-wide)
+- [ ] Tests cover both success and error paths
+- [ ] No hardcoded filesystem paths in tests (use temp dirs or mocks)
+
+## 6. Freebuff-Specific
+
+- [ ] Session changes respect `IS_FREEBUFF` guards
+- [ ] Auth changes don't break the login modal → polling → credential save flow
+- [ ] Free session state transitions are handled: `none → active → ended → none`
+- [ ] Changes to `freebuff-session-store.ts` maintain the one-instance-per-account invariant
+
+## 7. Files to Watch
+
+| File | Why |
+|------|-----|
+| `cli/src/utils/auth.ts` | Credential storage — changes affect login/logout/profile |
+| `cli/src/state/freebuff-session-store.ts` | Session state — changes affect all session lifecycle |
+| `cli/src/hooks/use-freebuff-session.ts` | Poll loop — complex async state machine |
+| `cli/src/commands/command-registry.ts` | Slash commands — user-facing behavior |
+| `sdk/src/index.ts` | Public API — breaking changes affect external users |