feat: add Python/async/SSRF patterns to review checklist

[keshav55]

Summary

Adds Python-specific patterns to review/checklist.md. Every pattern here caught a real bug on a production Python/FastAPI/Supabase codebase.

CRITICAL additions

• Shell Injection (Python): subprocess.run(shell=True) with f-strings, os.system(), eval()/exec() on LLM output
• LLM Trust Boundary: SSRF via LLM-generated URLs, stored prompt injection via knowledge base writes

INFORMATIONAL additions

• Async/Sync Mixing: blocking calls in async endpoints (subprocess.run, open(), requests.get inside async def)
• Column/Field Name Safety: wrong column names in ORM queries silently return empty results

Evidence

These patterns were discovered by applying the existing checklist to a production codebase:

• Shell injection in subprocess.run(f"grep -rl '{name}'...", shell=True) — real bug, fixed
• Wrong column name .gte("created_at", ...) on a table using timestamp — 3 endpoints silently returning 0, fixed
• SSRF: LLM-provided URL fetched without validation, content stored as agent knowledge — real vulnerability, fixed

Test plan

• 365/365 skill validation tests pass
• No conflicts with existing checklist categories

🤖 Generated with Claude Code

[keshav55]

Hey Garry — stoked the Python patterns made it into v0.12.9.0! We've been deep in gstack for the past few days and love what you've built.

Quick thought on the wave merge process: when community PRs get squashed into a single commit, the original contributors lose their green squares on GitHub. Might be worth adding Co-Authored-By trailers to wave commits — it's a small thing but contributor graphs are a big motivator for open source contributors. People see "I contributed to a 50K-star repo" on their profile and it drives more PRs.

For the v0.12.9.0 wave, something like:
Co-Authored-By: keshav55 <[email protected]>

CONTRIBUTING.md already mentions preserving attributions in wave PRs, so this would just be closing the loop on that.

We have 3 more PRs open (#529, #530, #532) and would love to keep contributing. Incredible project.