Update commit attribution and PR review instructions

[gtsiolis]

Motivation

Instruction updates for agents working in lstk:

• Commit/PR attribution: flip the default to include a Co-Authored-By: Claude trailer instead of omitting it, per https://localstack-cloud.slack.com/archives/C0A1857LGTU/p1784718110278849. The no-attribution rule was originally added in Restructure agent instructions and skills #366.
• Review process: document the hybrid approval model (small PRs/bug fixes can merge without a human approval when confident; bigger features/PRs still need review as usual), shifting more weight onto self-review via /review-pr.
• Review visibility: instead of a GitHub label, the agent now says in-session whether a human review looks advisable and adds a short "Review" line to the PR description itself, so the assessment is visible to the author and anyone reading the PR.

Changes

• CLAUDE.md: commit messages now get a Co-Authored-By: Claude <noreply@anthropic.com> trailer; added a bullet on the small-PR/bug-fix approval exception, the expectation to self-review with /review-pr before treating a change as done, and the in-session + PR-description review callout.
• .claude/skills/review-pr/SKILL.md: added a "Review scope" checklist (self-merge vs. needs human review) and a review-recommendation line to the output.
• .claude/skills/create-pr/SKILL.md: Step 6 now adds the co-author trailer by default instead of omitting it; the PR body template now includes a "## Review" section stating self-merge candidate vs. human-review-advised with a reason, and instructs stating that assessment in the session before creating the PR rather than deciding it silently.

Review

Self-merge candidate — docs/instructions-only change implementing an already-discussed review-process update from the linked Slack thread; no code or user-facing behavior touched.

Tests

Docs/instructions only, no code changes.

Closes: none (internal instructions update, no Linear ticket)

[gtsiolis]

Merging once checks pass.