[codex] add bounded spam risk reviewer skill

[bbbbzzzzcc-afk]

What changed

• adds the spam-risk-reviewer Runx skill
• declares typed campaign, list-hygiene, and sender-auth inputs
• emits a bounded send_risk_verdict without sending or granting authority
• includes one clear case and one blocked needs_agent/human-approval case
• includes standalone fixtures and captured harness evidence

Why

Outbound systems need a deterministic pre-send judgment that prevents a
separate send-as run from clearing preflight when authentication or list
hygiene is unsafe.

Impact

Operators can evaluate supplied SPF, DKIM, DMARC, warm-up, bounce, complaint,
and freshness evidence before invoking a separate governed delivery workflow.
The skill owns no public_send effect and performs no repository or campaign
mutation.

Validation

• runx-cli 0.6.14
• runx harness ./skills/spam-risk-reviewer --json
• 2 cases passed with 0 assertion errors
• published as bbbbzzzzcc-afk/spam-risk-reviewer@sha-cf7c9972e03d
• clean registry install passed
• post-publish dogfood receipt verified with valid=true