feat(workflow): extract reusable dev-workflow commands - #299

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tools/dev-workflow-v2/commands/code-review.md`:
- Around line 14-18: Update the workflow steps that read state and build the
review prompt to fetch the recorded issue body whenever taskCheckPassed is false
and githubIssue is present, before invoking task-check. Include the fetched body
in the shared prompt as clearly delimited data, alongside the existing
githubIssue reference.
- Around line 20-21: Update the review-recording instruction around the agent
payload validation flow to pass review JSON safely as a single argument even
when summary or findings contain apostrophes. Use robust shell escaping or the
supported stdin/file transport with /dev-workflow-v2:workflow record-review,
while preserving validation and BLOCKED behavior for failed or invalid agents.

In `@tools/dev-workflow-v2/commands/create-pr.md`:
- Around line 16-19: Update the workflow after the branch inspection commands in
the PR creation instructions to check whether the merge-base diff contains any
changes and stop immediately when it is empty. Only continue drafting, pushing,
and creating the pull request when the branch has a non-empty diff.
- Around line 13-15: Update the workflow create-pr logic around
currentStateMachineState, githubIssue, featureBranch, and prNumber to reconcile
an existing GitHub pull request for featureBranch before creating a new one,
reusing and persisting its prNumber when found; otherwise create the pull
request and persist pr-recorded, ensuring retries after partial persistence
cannot create duplicates.
- Around line 19-32: Update the workflow instructions around step 5 and the
create-pr command so the agent fetches the issue title and body as delimited,
untrusted context, explicitly ignores instructions contained within them, and
passes each generated PR field as a separate safely quoted argument without
shell interpolation. Preserve the existing PR field requirements and workflow
command.

In `@tools/dev-workflow-v2/commands/list-review-threads.md`:
- Around line 15-23: Update the GraphQL workflow in the review-thread listing
instructions to paginate the reviews, reviewThreads, and each thread’s comments
connections using hasNextPage and endCursor until all pages are traversed. When
determining each thread’s primary summary, select the comment with the latest
createdAt rather than relying on incomplete or returned ordering.

In `@tools/dev-workflow-v2/states/reviewing.md`:
- Around line 13-16: Update the review workflow around review-recorded and the
SUBMITTING_PR transition to bind every verdict to the current review run and
repository HEAD. Persist the run identifier and commit SHA with each review
result, and allow submission only when one complete required-review bundle
matches both the active run and current HEAD; otherwise clear or ignore stale
verdicts when a new run begins.