feat(yc-review): retrieve live YC application content + partner-style review

[time-attack]

What this adds

A new /yc-review skill that retrieves your live YC application content —
the answers currently saved in your Y Combinator application — and gives you a
blunt, field-by-field partner-style review of them.

It reads the application directly from your authenticated browser session:
no copy-paste, no exported file, no re-typing your answers. Whatever is saved in
your application right now on apply.ycombinator.com is what gets pulled and
reviewed. The skill rates your one-liner, what you're building, founder-market
fit, traction, competition, and business model, then closes with a fundability
verdict (PASS / BORDERLINE / NO), your top three strengths, the three things to
fix before your interview, and the interview questions your weak spots will invite.

Because it reads your live saved content, the review always reflects the current
state of your application — edit an answer, re-run /yc-review, and the critique
updates with it.

How it reads your application (auth)

No new auth surface. The skill drives the browse session against
apply.ycombinator.com and reuses the existing browser cookie-import flow (the
same path as /setup-browser-cookies):

1. Loads apply.ycombinator.com; if you're already authenticated (CDP mode or a
   prior import) it goes straight to reading your application.
2. Otherwise it detects your installed browser (Comet / Chrome / Arc / Brave /
   Edge) and imports your existing YC session cookies — the login you already
   have in your real browser. You never enter a password.

Once authenticated, it reads your saved application content through YC's own
GraphQL API from inside the page session, exactly as the apply dashboard does.

YC splits its login across two domains — .ycombinator.com (parent SSO cookies)
and apply.ycombinator.com (host session cookie) — and the API needs both. The
skill handles this two-domain import itself. No changes were made to the shared
browser cookie-import code, so this quirk is not generalized to any other site.

Scope / what this does NOT touch

• No changes to browse/src — core browser and cookie-import behavior is
  unchanged for every other site and skill.
• No other skill modified — only the new yc-review/ is added.
• Nothing stored on disk — no application content, no credentials, no cookies
  persisted by the skill. It reads your live session and reviews it in place.

Files

• yc-review/SKILL.md.tmpl + generated SKILL.md — the skill
• AGENTS.md, docs/skills.md, gstack/llms.txt, scripts/proactive-suggestions.json — index entries
• CHANGELOG.md, VERSION, package.json — 1.55.0.0 -> 1.56.0.0

Testing

• bun test passes (the 2 pre-existing strict-YAML frontmatter failures on
  main are unrelated to this change — verified by running the suite on a clean
  tree).
• Verified end-to-end against a real submitted application: the skill imports the
  browser session cookies and pulls the live saved application content, and the
  review renders.

Note for reviewers

This is a fork PR, so the paid eval / E2E CI jobs will fail with empty-env auth
(fork PRs don't receive base-repo secrets). The free test tier still runs.

🤖 Generated with Claude Code