feat: add orcarouter cross-model review skill

[XiaoHuo888-hue]

Summary

This registers OrcaRouter the same way the existing gemini skill is wired, so the cross-model review catalog, resolver and install docs stay consistent. OrcaRouter is an OpenAI-compatible gateway: one ORCAROUTER_API_KEY (keys start with sk-orca-) unlocks 150+ models from OpenAI, Anthropic, Google, DeepSeek, Qwen, MiniMax and xAI behind a single https://api.orcarouter.ai/v1 endpoint. It also runs gateway-level, zero-trust security for AI agents on the same endpoint - screening every prompt/response and governing every tool call on a default-deny basis, with no application code changes.

I'm an engineer on the OrcaRouter team.

What this changes

• orcarouter/SKILL.md: new canonical skill mirroring gemini/SKILL.md with review, challenge, and consult modes for code, Google Ads, and SEO changes. It calls OrcaRouter with curl, so no per-vendor CLI install is needed. It defaults to the orcarouter/auto smart router and honors an optional ORCAROUTER_MODEL override to pin a specific model.
• skills/orcarouter/SKILL.md: Codex wrapper that forwards to the canonical skill, keeping frontmatter in parity.
• .claude-plugin/plugin.json: registers ./orcarouter in the skills array, bumps version to 0.28.0.
• .claude-plugin/marketplace.json, .codex-plugin/plugin.json, VERSION: version bumped to 0.28.0 in lockstep.
• AGENTS.md: adds the orcarouter row to the Cross-model review table and documents the API key dependency.
• README.md: adds the skill to the cross-model review catalog, the integrations table, and the repo tree; updates the skill count to 46.
• INSTALL_FOR_AGENTS.md: documents the ORCAROUTER_API_KEY requirement.
• CHANGELOG.md: adds the v0.28.0 entry under Unreleased.

Why a separate skill rather than reusing the Gemini path

The gemini skill requires npm install -g @google/gemini-cli plus a one-time Google authentication. OrcaRouter is OpenAI-compatible and needs only an API key, so it works in hosts where installing a Gemini CLI is not an option. Its default orcarouter/auto router picks the best upstream model per request, which yields a genuinely independent second opinion from a different model family than the one doing the work.

How to use it

1. Get an API key at https://www.orcarouter.ai/console (keys start with sk-orca-).
2. Set ORCAROUTER_API_KEY.
3. Run /notfair:orcarouter review (or challenge / consult), optionally pinning a model via ORCAROUTER_MODEL such as openai/gpt-5.5 or anthropic/claude-sonnet-4.6.

Verification

• python3 -m pytest test/unit/ - 270 passed.
• python3 -m pytest -q - 270 passed, 14 skipped, 8 subtests passed.
• Registration contract (from test_mcp_skill_e2e.py): 46 Codex wrappers match the 46 registered skills, and the orcarouter canonical/wrapper frontmatter are byte-identical.
• JSON manifests parse; version is 0.28.0 across plugin.json, marketplace.json (both fields), .codex-plugin/plugin.json, and VERSION.
• Live API: POST https://api.orcarouter.ai/v1/chat/completions with orcarouter/auto returned HTTP 200 (routed to gemini-3.1-flash-lite) and produced the full structured review. Pinning openai/gpt-5.5 also returned HTTP 200.

Note: test_mcp_skill_e2e.py::test_universal_mcp_is_the_only_registered_server_and_skills_use_platform_prefixes currently fails on main as well: the broken-link-checker canonical frontmatter has a trailing space that its Codex wrapper lacks, so the byte-identical frontmatter assertion trips. This PR does not touch that skill; I can open a follow-up one-character fix if helpful.