docs(review): three-way (Claude+Gemini+Grok) codebase review + remediation plan

Independent reviews of server/agent/dashboard by Gemini 3.1 Pro and
Grok 4.3, each reading source via its own read_file tool, plus a Claude
synthesis and a phased remediation plan. Top convergent finding:
secrets/tokens in WebSocket URL query strings across agent + dashboard.
See SYNTHESIS-three-way.md and REMEDIATION-PLAN.md.

reports/review-2026-06-05/run-review.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# run-review.sh <gemini|grok> <subsystem> <files-list> <out-file>
+set -uo pipefail
+TOOL="$1"; SUB="$2"; LIST="$3"; OUT="$4"
+ROOT="/d/claudetools"
+case "$TOOL" in
+  gemini) SCRIPT="$ROOT/.claude/skills/agy/scripts/ask-gemini.sh" ;;
+  grok)   SCRIPT="$ROOT/.claude/skills/grok/scripts/ask-grok.sh" ;;
+  *) echo "bad tool"; exit 2 ;;
+esac
+INSTR="You are doing an independent code review of the GuruConnect ${SUB} (a Rust/TypeScript remote-support/remote-control platform: agent <-> relay server <-> browser viewer, protobuf wire protocol, JWT auth, support-code session binding). Review ONLY the files provided. Produce a prioritized findings list. For EACH finding give: [SEVERITY: CRITICAL/HIGH/MEDIUM/LOW], file:line, the problem, and a concrete fix. Focus on: (1) security — auth/JWT, session takeover, support-code binding, input validation, SQL injection, secret handling, IDOR/authorization, rate-limit bypass; (2) correctness & concurrency — relay/session state races, deadlocks, panics/unwraps, error handling, resource leaks; (3) protocol/wire integrity; (4) architecture & maintainability. Be concrete and skeptical. End with a short overall assessment and the single most important thing to fix."
+mapfile -t FILES < "$LIST"
+echo "# GuruConnect ${SUB} review — ${TOOL} — 2026-06-05" > "$OUT"
+echo "" >> "$OUT"
+bash "$SCRIPT" review-files -i "$INSTR" "${FILES[@]}" >> "$OUT" 2>> "${OUT}.err"
+echo "EXIT=$? files=${#FILES[@]}" >> "${OUT}.err"