fix(review): harden explain-change overlay containment, risk_paths globbing and stale references #6110

Context

Found in the reviews of #6018 (feat(review): add review:explain-change with a digest policy and an interactive view) and #6013 (feat(education)!: replace eli5 with illustrate). Found while delivering spec container #5835.

Problem

From #6018:

1. The digest overlay has no realpath containment check. A symlinked .claude is rejected today only incidentally.
2. risk_paths glob matching can backtrack catastrophically on a pattern from a trusted layer.
3. records.json rulings still name review:pr-explainer.

From #6013:
4. The SKILL.md heredoc could pass the model through a scratch file instead.
5. Where the explainer-video output lands relative to the record is owned by that plugin and should be confirmed there.

Suggested fix

1. Resolve the overlay path with realpath and require it to stay inside the repo before reading.
2. Bound or linearize the glob matcher (no nested quantifier expansion) and cap pattern length.
3. Update the records.json rulings to the current skill name.
4. Write the model to a scratch file and pass the path.
5. Confirm and document the output location with the explainer-video owner.

Related: #5835