Add surgeon-reviewer: zero-noise code review with severity tiers

[LucianFord]

Summary

Adds surgeon-reviewer to categories/04-quality-security/ — a code review subagent that reports only real problems, ranked by blast radius, with zero style opinions.

What it does differently

Most review agents mix genuine bugs with style preferences and hypothetical issues. surgeon-reviewer applies a single filter to every candidate finding: "If this code ships as-is, what concretely goes wrong, for whom, and how bad is it?" Findings that fail the test are deleted from the report.

• Three fixed severity tiers: WILL BREAK (incorrect behavior under realistic usage), WILL COST (ships fine, bleeds later — N+1s, unbounded growth, missing indexes), WILL ROT (works today, punishes the next change)
• Explicit verdict on every review: SHIP / SHIP WITH FIXES / DO NOT SHIP
• Suspicion falsification: actively tries to disprove each candidate finding against guards, invariants, and call sites before reporting it
• Documents its own known failure modes (diff blindness, alarm inflation, intent guessing)

Testing

Developed and benchmarked against the OWASP NodeGoat vulnerable application, where it correctly surfaces reachable security holes and data-loss paths without flagging style issues.

Source

From the open-source Agent Pack collection (MIT license), with attribution included in the agent file, following the precedent of ai-writing-auditor.

Checklist

• Agent file follows the category template (frontmatter, role, capabilities, example usage, best practices)
• Main README.md updated (alphabetical order)
• Category README.md updated (Available Subagents + Quick Selection Guide)
• Category plugin.json version bumped (1.1.1 → 1.1.2), agents list updated
• marketplace.json version kept in sync

[necatiozmen]

Thanks, this is a well-built agent. I pushed one small commit to your branch: dropped the "production-tested, benchmarked against OWASP NodeGoat" claim from the Source note, since we keep unverifiable metrics out of agent files (see #308). Merging.