Add product reverse engineering router

[droxey]

Summary

• add product-reverse-engineering with the exact five-route contract for live products, authorized repositories/static binaries, business mechanics, UI rebuilding, and source-to-PRD work
• pin every external dependency by canonical origin, exact path, immutable commit, frontmatter identity, and license evidence; fail closed on missing, mutable, mismatched, or unverified fields
• enforce static-only binary defaults, block unsupported dynamic tracing, require full-surface rights for clone-ui, and protect credentials, sessions, personal data, untrusted content, and consequential actions
• add a 20-case machine-readable routing suite, executable scorer, and scorer regression tests
• keep README/manifest registration additive and register the full skill folder in global sync; remove the duplicate workflow permissions key

Validation

• product router suite: 19 passed
• blind fresh-agent routing evaluation: PASS 20/20
• repository suite excluding the known compatibility file: 46 passed
• full PR branch: 48 passed, 1 failed; origin/main: 29 passed, 1 failed
• Skill Creator validation: Skill is valid!
• manifest JSON, routing JSONL, workflow YAML, Python compilation, shell syntax, sync smoke test, and git diff --check: passed
• independent safety/dependency and tests/catalog reviews: no remaining merge blockers

Known baseline failure

SyncSkillsCompatTests.test_script_avoids_bash4_only_builtins rejects the existing readarray use in scripts/sync-skills.sh. It reproduces on origin/main. The script and compatibility test are unchanged by this PR and have identical base/head blob IDs:

• scripts/sync-skills.sh: 36a32d5f2e493d81d63da726217f1181583cdd5e
• scripts/test_sync_skills_compat.py: df710dc5130caabf7d0dcd5d413f6f6d57e73f2b

Final verification commands

PYTHONPATH=reasoning-router python3 -m pytest -q product-reverse-engineering/tests
PYTHONPATH=reasoning-router python3 -m pytest -q --ignore=scripts/test_sync_skills_compat.py
PYTHONPATH=reasoning-router python3 -m pytest -q  # expected: the one baseline readarray failure above
python3 /root/.codex/skills/oai/skill-creator/scripts/quick_validate.py product-reverse-engineering
python3 -m json.tool skills-manifest.json >/dev/null
jq -e -c . product-reverse-engineering/tests/routing-cases.jsonl >/dev/null
bash -n scripts/sync-skills.sh
bash -n scripts/test-sync-skills.sh
bash scripts/test-sync-skills.sh
git diff --check origin/main...HEAD

No merge was performed.