Address 6 issues found in PR #223 generated by the code-simplifier:

1. Add ci-bot.yml to run CI on bot-created PRs (workflow_run trigger)
   - GitHub blocks pull_request triggers for PRs from github-actions[bot]
   - Runs stylua, luacheck, and plenary tests on the PR branch
   - Reports combined status back to the PR commit

2. Add tool installation instructions to code-simplifier prompt (Phase 3.0)
   - Neovim, plenary.nvim, luacheck, stylua install commands
   - Blocks PR creation if any tool fails to install

3. Add type annotation verification step (Phase 2.3, step 4)
   - Requires reading type definition files before writing annotations
   - Prevents inferring types from runtime behavior alone

4. Add post-refactor standards audit (Phase 3.4)
   - Checks nesting depth, function length, file size, immutability
   - Reverts changes that violate project coding standards

5. Add human reviewer alongside copilot
   - Changed reviewers from [copilot] to [copilot, YousefHadder]

6. Add minimum impact threshold (Principle 5)
   - Skips low-value changes like local variable renames in small scopes
   - Requires measurable improvement: DRY, complexity, or standard fix

Also adds network.allowed (github + lua ecosystems) for tool downloads.

- Fix plenary install: set PLENARY_DIR default before testing directory
  existence to make the check idempotent
- Fix stylua install: use $HOME/.local/bin and .tar.gz instead of
  /usr/local/bin and .zip to avoid sudo and unzip dependencies
- Fix ci-bot PR detection: correlate PR to triggering workflow via
  title prefix map instead of a blind 2-hour window scan
- Recompile agentic workflows (gh-aw v0.53.6 → v0.54.0)

- Remove checks:write and statuses:write from top-level permissions
  so test/lint jobs run with read-only access (report-status already
  has its own statuses:write block)
- Expand stylua check to lua/ spec/ plugin/ to match make format-check