Promote recurring pr-flow/board-ops command blocks into scripts/ helpers

[BobDickinson]

Problem

The pr-flow and board-ops skills embed multi-line bash blocks that agents (and humans) reconstruct from scratch on every use. During the #2556 review loop the same blocks were rebuilt repeatedly:

• the review-wait loop (pr-flow 7b, ~30 lines) — rebuilt 5×
• the requestReviews GraphQL block (pr-flow 7a, hardcoded bot id) — 5×
• the paginated round-fetch + jq (pr-flow 8) — every round
• the card status move (pr-flow 1/6, board-ops) — 2×, and the most fragile: a half-pasted block silently no-ops

Each reconstruction is re-reviewed/re-approved from scratch, and any transcription slip (wrong jq filter, missed --paginate) fails in ways the skill prose can only warn about.

Proposal

Add a small maintainer-workflow category to root scripts/ (joining the existing gate-lease / skill-eval precedent), with npm aliases and stable stdout contracts:

Script	npm alias	Prints
scripts/pr-review-request.mjs	pr:review-request -- --pr N	confirmation; owns the bot id + GraphQL mutation
scripts/pr-review-wait.mjs	pr:review-wait -- --pr N --expected K	exactly one of ROUND=posted|ended-without-review|timed-out; non-zero exit on API/parse failure (never retries blind)
scripts/pr-review-fetch.mjs	pr:review-fetch -- --pr N [--review ID]	the round's comments (id, path:line, body), paginated
scripts/board-card-status.mjs	board:status -- --issue N --status "In Review" [--board 28]	card: <Status> only on verified success; all ids resolved by name at run time

• Node .mjs with sibling *.test.mjs (pure logic tested; gh invocations behind a thin injected runner), matching the existing scripts/ conventions — flat layout, scripts/lib/ for shared gh/paging helpers.
• SKILL.mds updated to invoke, not transcribe: each skill keeps the decision tables and the why, and names the command instead of embedding the bash.
• Shell out to gh for auth, like the existing sweeps.

Why root scripts/ and not skill-embedded scripts

• scripts/*.mjs is already inside the test (node --test), lint, and format scopes; skill folders are outside all of them.
• These encode repo facts (Copilot bot id, owner/repo, board invariants) — repo tooling like sdk-watch.mjs, not skill prose.
• Node ≥22.19 is a checked repo requirement; Python is not.

Surfaced while running the review loop on #2556.