feat(release): bootstrap first-time winget submissions - #28

## Summary

`cr` ships no reviewers: with no profile `agent_sources`, no repository
`.codereview/agents/` and no `--agents-dir`, `cr review` stops with "no
reviewer agents available". Everything a review checks comes from agent
prompts someone has to write. This adds `starter-agents/`, a general
catalog to use as a profile agent source, and documents how to build on
it.

**Agents** (14):

- Always run when their globs match (`required_on_match`):
`general:correctness`, `general:repo-conventions` (checks changes
against the rules a repository writes in `AGENTS.md`, `CLAUDE.md`,
`CONTRIBUTING`, `ARCHITECTURE` and `docs/`, including nested `AGENTS.md`
files above each changed path, and cites the document and section), and
`documentation:docs`.
- Selected per PR: `tests:behavior`, `security:trust-boundaries`,
`architecture:design`, `structure:repo-health`, `automation:ci-release`,
`go:implementation-tests`, `rust:implementation-tests`,
`tauri:config-ipc`, `macos:swift-appkit`, `frontend:correctness`,
`frontend:accessibility`.

Every prompt shares one review bar: report only what the PR introduces
or worsens, with a concrete consequence and the input or sequence that
shows it, stated as confirmed or inferred, actionable from the changed
code, and not already caught by a tool the repository runs. Each also
has a "What not to report" list and a severity scale for its lane.

**Docs:** `starter-agents/README.md` covers using the catalog as a
profile source, extending it with an organization catalog and
repository-local agents (including how a repository-local agent with the
same ID replaces a starter agent), and turning `AGENTS.md` rules into a
repository-local conventions reviewer. `README.md`,
`docs/review-guidance.md` and `docs/development.md` point to it.

**This repository:** the Rust, Tauri and macOS agents move from
`.codereview/agents/` into the catalog, since they never apply to this
repository's own PRs. The remaining repository agents replace
`documentation:docs`, `structure:repo-health`, `automation:ci-release`
and `go:implementation-tests` by ID when this repository is reviewed
with the starter catalog as a profile source.

**Test:** `internal/agents/starter_catalog_test.go` loads the catalog
with the strict profile-source parser, requires the three baseline
agents to stay `required_on_match`, and fails when
`starter-agents/README.md` does not list an agent (checked by removing
one row from the table).

## Validation

Dry runs with the catalog passed through `--agents-dir`, pinned with
`--review-base-sha`/`--review-head-sha` and `--without-discussion`,
nothing posted:

- open-cli-collective/atlassian-cli#478 at the
first commit the existing reviewers saw (`ba163234`). The starter
reviewers that ran (`general:correctness`, `documentation:docs`,
`tests:behavior`, `architecture:design`, `go:implementation-tests`)
reported 4 of the 6 problems the first published review raised: the
lossy-write guard failing open when the storage body is missing, the
undocumented `structured macros` rule, regex matching that only catches
adjacent markup, and README text naming two constructs where the code
refuses three. They also reported two the published review did not: the
README adds `--allow-lossy` to the `page create` flag table though only
`page edit` registers it, and the refusal tests never check that no
write reached the server. `general:repo-conventions` reported nothing.
- open-cli-collective/.github#28 at its final
head: `general:correctness` reported that the checksum download sends an
`Authorization` header that urllib carries across the asset API's
redirect to the storage host (not yet confirmed against a live run), and
`tests:behavior` reported untested fail-closed branches in the asset
resolution.

## Type of Change

- [ ] Bug fix
- [x] New feature
- [x] Documentation update
- [ ] Repo scaffolding / maintenance

## Checklist

- [x] I have read the contributing guide
- [x] My change follows the project structure and conventions
- [ ] `make tidy` passes
- [x] `make lint` passes
- [x] `make test` passes
- [x] `make build` passes

## Related Issues

Proposal for giving every reviewer base-pinned guidance without
per-prompt discovery: #682.

<!-- twapp-session: b7acef9e-0a9c-4af5-8ab8-775953bbc6e1 -->

Model: Claude Opus 5.5 (1M context, xhigh effort) in Claude Code.