feat(examples): add automated code review agent example (Skills + sandbox + DB storage)

[DNKYr]

Summary

Adds examples/skills_code_review_agent/ — an automated code-review agent prototype that integrates the tRPC-Agent SDK's Skill system, workspace runtimes (local/container/cube), Filter governance, and SQL persistence.

Closes #92.

What's Included

• code-review Skill: SKILL.md + 5 rule-category checker scripts (security, async leaks, DB lifecycle, missing tests, secrets) that print structured JSON findings to stdout
• Sandbox execution: container runtime (default, python:3-slim) via env -i environment whitelist, 60s timeouts, 256KB output caps; local fallback (dev-only); cube support (env-configured)
• Governance engine: script allowlist, forbidden paths, network deny, execution budget, risk escalation (needs_human_review); dual enforcement via deterministic orchestrator + BaseFilter tool guard on skill_run
• Structured findings: pydantic model with severity/category/file/line/evidence/recommendation/confidence/source; dedup by (file, line, category); confidence gating (low → needs_human_review)
• SQL persistence: 6-table SQLAlchemy schema (review tasks, sandbox runs, findings, filter events, metrics, reports) via SDK SqlStorage; default SQLite, swappable db_url
• Redaction: shared secret-pattern module used by both sandbox checker and host-side redact layer; full-chain redaction (script evidence, sandbox output, DB writes, file output)
• Fake model / dry-run: FakeReviewModel(LLMModel) so the entire pipeline runs without API keys
• Reports: review_report.json + review_report.md with findings, severity stats, filter intercepts, sandbox runs, metrics
• CLI: review (--diff-file / --repo-path / --fixture, --runtime, --dry-run) + show --task-id
• 8 fixture diffs + 65 tests: covers clean, security, async_leak, db_lifecycle, missing_test, duplicate, sandbox_failure, secret_leak; dry-run ≤2 min (actual ~5s)
• README: usage guide, architecture diagram, rule table, schema table, 方案设计说明 (Chinese design explanation)

Verification

python -m pytest examples/skills_code_review_agent/tests -q   # 65 passed, 1 skipped
bash lint_flake8.sh examples/skills_code_review_agent         # clean
python run_agent.py review --fixture security_eval --runtime local --dry-run  # produces reports

Container mode: opt-in via CR_CONTAINER_TESTS=1 (requires Docker).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@e113610). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff             @@
##             main        #198   +/-   ##
==========================================
  Coverage        ?   87.54280%           
==========================================
  Files           ?         467           
  Lines           ?       44103           
  Branches        ?           0           
==========================================
  Hits            ?       38609           
  Misses          ?        5494           
  Partials        ?           0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.