Fix PR Review Panel: emit advisory comment via add_comment tool, not a shell heredoc

[Copilot]

Description

The PR Review Panel workflow's agent job terminated unexpectedly (run 27815857237, 33m / 144 turns, no comment posted). gh aw audit shows the CEO synthesizer produced a valid needs_rework recommendation, but the orchestrator then staged the rendered comment body in a temp file with a shell heredoc:

cat > /tmp/gh-aw/agent/panel-comment.md << 'COMMENT_EOF'
... correctness bugs silently kill the feature's display layer ...

The copilot engine's bash command-safety parser scans command text (heredoc bodies included) and read a word-wrapped line beginning with kill as a real command, refusing it: "Command not executed. The 'kill' command must specify at least one numeric PID." The comment never emitted and the run failed. The add_comment safe-output tool already takes the body as a structured argument, so panel prose never needs to touch the shell.

Changes (prose-only in the skill):

• apm-review-panel SKILL step 7 — mandate emitting the single comment by passing the rendered markdown directly to the add_comment tool's body argument; forbid staging/piping it through the shell (cat <<EOF, printf, echo, temp .md files), with the kill/rm/sudo parser hazard called out.
• New Gotcha documenting the failure mode and citing run 27815857237.
• Mirrored both edits into the installed .agents/skills/apm-review-panel/SKILL.md copy (kept byte-identical).
• Removed accidentally-committed gh aw audit artifacts under .github/aw/logs/ and gitignored that path.

No workflow recompile needed — the workflow imports the skill from microsoft/apm#main at runtime, so .lock.yml is unaffected.

Type of change

• Bug fix
• New feature
• Documentation
• Maintenance / refactor

Testing

• Tested locally
• All existing tests pass
• Added tests for new functionality (if applicable)

Spec conformance (OpenAPM v0.1)

If this PR changes behaviour that an OpenAPM v0.1 req-XXX covers,
confirm the three-step ritual (see CONTRIBUTING.md "Adding or
changing a normative requirement"):

• Spec edit: docs/src/content/docs/specs/openapm-v0.1.md updated
  (new/changed <a id="req-XXX"></a> anchor + prose + Appendix C
  row).
• Manifest edit: docs/src/content/docs/specs/manifests/openapm-v0.1.requirements.yml
  updated.
• Test edit: a @pytest.mark.req("req-XXX") test under
  tests/spec_conformance/ added or extended.
• CONFORMANCE.{md,json} regenerated via
  uv run --extra dev python -m tests.spec_conformance.gen_statement
  and committed.
• N/A -- this PR does not change OpenAPM-observable behaviour.