fix(quest): bundle portable publication safety checks

[randomparity]

The forge-review publisher depended on a repository maintenance script outside the quest skill. Move the existing scanner into the skill and resolve it beside the publisher; keep the repository gate as a thin wrapper over that same implementation.

Remove maintainer-specific domain patterns, add case-insensitive Windows profile-path detection, and check scanner dependencies before composing a publication. Missing tools now name an installation/PATH remedy. Unsafe content and scanner faults stop publication with distinct messages that do not echo private content.

The scanner remains deterministic executable code because publication must stop on an unsafe body or an incomplete scan. This relocates the existing implementation rather than adding a second scanner. The repository wrapper preserves its default checkout scope. Plugin version: 4.7.1.

Validation:

• New regression tests failed on the original implementation for isolated skill publication and Windows profile paths.
• Scanner and publication suites pass, including missing rg/jq, scan faults, private evidence retention, and mocked GitHub publication/readback/disposal from the isolated skill.
• A controlled removal of the rg preflight check in a disposable copy failed the new dependency test: composition began before the missing dependency was reported. The mutation was removed with the disposable copy.
• The managed pre-push hook ran the complete just verify successfully on commit 5095a43: 214 record assertions and 26 test suites passed, plus lint, formatting, safety, packaging, version declaration, and workflow gates.
• The version bump check also passed against the base commit. The initial local workflow gate found a host zizmor version mismatch; the required 1.29.0 was supplied through an isolated uv tool environment. Local zizmor ran offline; CI performs the online pin-provenance audit.
• Native validation uses macOS and Bash 3.2; Linux validation is delegated to the existing CI matrix.

Requested as one change for #338 and #339. Attunement-wide tool validation is tracked separately in #340.

Closes #338
Closes #339