docs(skill): синхронизация README, фикс рекомендации Codex sandbox

- Зачем:
  - README отстал от SKILL.md после двух раундов self-review — формы инвокации, /agent, disallowedTools описаны неверно.
  - Рекомендация Codex sandbox_mode = "read-only" была ошибочной: она запрещает не только запись, но и exec — ревьюер не сможет запускать тесты, линтеры, git, MCP-запросы (а это основа верификации находок).
- Что:
  - README и SKILL.md: блок «Tool restrictions» переписан — briefing-only по умолчанию на обоих хостах; жёсткая sandbox упомянута как опция с явным trade-off (на Codex теряется exec).
  - README: Usage block обновлён — добавлены code-vs-plan и code-vs-plan <plan-path>, явное правило bare <file-path> → plan, xhigh как ортогональный effort flag.
  - README: новая короткая секция Language (ответы ревьюера на языке оператора, без флага).
  - README: bullet про structural-only паузы оператора в «What the lead does».
  - README: /agent в Codex section переформулирован как CLI оператора, а не tool лида.
- Проверка:
  - git diff main..HEAD -- README.md SKILL.md
  - Прочитать README целиком и убедиться, что нет противоречий с SKILL.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

SKILL.md

@@ -145,19 +145,25 @@ prose, reasoning, descriptions, recommendations — in
 The verbatim reply from the reviewer is shown to the operator as-is — do
 not translate it back; it should already be in the operator's language.
 
-**Tool restrictions:** the briefing's "must NOT modify files" rule is
-the primary control on the read path. The built-in `general-purpose`
-subagent on Claude Code has no tool-restriction knob the lead can pass
-at invocation time, so the briefing rule is the only control there. If
-you want enforced sandboxing on top, that requires going off the
-default path:
+**Tool restrictions.** The briefing's "must NOT modify files" rule is
+the primary control on both hosts and the default. **Do not reach for
+host-level sandboxes by reflex** — the reviewer also needs to run
+things (tests, linters, git, MCP queries) to verify findings, and
+hard sandboxes that block writes typically block exec too, which guts
+the reviewer.
+
+If the operator explicitly wants enforced no-write on top and accepts
+the trade-off, both hosts have an option:
 
 - **Claude Code:** define a custom subagent (e.g.
   `~/.claude/agents/adversarial-reviewer.md`) with frontmatter
   `disallowedTools: Write, Edit`, and dispatch that agent type instead
-  of `general-purpose`.
-- **Codex:** the host's `sandbox_mode = "read-only"` applies to the
-  spawned subagent natively.
+  of `general-purpose`. The built-in `general-purpose` has no
+  invocation-time tool-restriction knob.
+- **Codex:** `sandbox_mode = "read-only"` applies natively, **but also
+  disables shell exec for the subagent** — the reviewer will not be
+  able to run tests or commands. Use only when the operator wants a
+  read-only audit and is willing to give up empirical verification.
 
 ---