Emit human-readable domain label on review findings

[JesperSchulz]

What & why

Today a review finding does not carry its own review-domain label. Consumers (notably the BCApps PR-review orchestrator) hardcode a map from sub-skill id → human display label, which has to be edited every time BCQuality adds a domain. This couples consumers to BCQuality's internal taxonomy.

This change makes the producer emit the label:

• Adds a new optional field findings[].domain to the DO review output contract (skills/do.md): a short, human-readable display label for the review domain that produced the finding.
• Each of the 11 leaf review skills sets domain on every finding it emits, to the fixed label for that skill.
• The al-code-review super-skill copies each sub-skill finding's domain verbatim during rollup (right where it already sets from-sub-skill), and sets domain: "Agent" for the cross-cutting agent findings it emits itself.
• Consumers render finding.domain as-is.

Label list

Skill	Label
al-security-review	Security
al-privacy-review	Privacy
al-performance-review	Performance
al-style-review	Style
al-ui-review	Accessibility
al-upgrade-review	Upgrade
al-breaking-changes-review	Breaking Changes
al-error-handling-review	Error Handling
al-events-review	Events
al-interfaces-review	Interfaces
al-web-services-review	Web Services
(super-skill agent findings)	Agent

Two judgment calls for reviewers

1. Display LABEL vs stable id — domain is a human display label (e.g. Security), not a stable kebab id (e.g. security). This keeps consumers zero-transform but means the producer owns wording. This can be revisited (e.g. emit both a stable id and a label) if a stable machine key is wanted.
2. Labelling al-ui-review "Accessibility" — this skill's domain is UI/accessibility; the chosen display label is Accessibility to preserve the consumer's current rendered output. Also revisitable.

Backward compatibility

The field is additive and optional:

• Consumers that don't read domain are unaffected.
• The companion BCApps PR reads finding.domain when present and otherwise falls back to its legacy sub-skill-id → label map, so nothing breaks until the BCApps BCQuality pin is bumped to include this commit.
• Older/partial producers that don't emit domain remain contract-valid.

Scope

Only skills/do.md and the 12 files under microsoft/skills/review/ are touched. No knowledge articles changed. Docs/contract only — no AL/build tooling involved.

Fixes: AB#640493