Add solana-program-review skill for on-chain program reviews

[nikw9944]

What

Adds a repo-local Claude Code skill at .claude/skills/solana-program-review/SKILL.md capturing this repo's review conventions for its Solana on-chain programs (passport and revenue-distribution). Claude Code auto-discovers it and applies it when reviewing on-chain program changes in this repo.

Where it comes from

Distilled from this repo's own PR review history — feedback classes (account & signer validation, PDA seeds+bump, CPI safety, checked arithmetic, rent/space/realloc, (de)serialization, testing, error handling, etc.), each with a concrete "what to look for in a diff" checklist and real verbatim review quotes linked to their PRs.

Scope

Scoped to this repo's Solana serialization model (bytemuck zero-copy + 8-byte precomputed discriminator, ZeroCopyAccount loaders). It deliberately excludes the DoubleZero Ledger conventions (borsh serde + 1-byte AccountType enum), which live in malbeclabs/doublezero and would be wrong here. Keeping the skill in-repo means a reviewer only ever sees this repo's conventions.

Part of a set: malbeclabs/doublezero and the other Solana program repo get their own repo-local skills.

Notes

• Documentation/tooling only, no code change.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds a repo-local Claude Code skill document to standardize how reviewers evaluate Solana on-chain program diffs in this repository, specifically aligned to this repo’s zero-copy/bytemuck + 8-byte discriminator account model and the historical review patterns for the passport and revenue-distribution programs.

Changes:

• Introduces a new .claude skill (solana-program-review) describing repo-specific on-chain review checklists.
• Captures concrete “what to look for in a diff” guidance across common Solana program risk areas (accounts/signers, PDAs, CPI, arithmetic, rent/space, testing, etc.).
• Includes linked, verbatim historical review quotes to anchor conventions to prior PR feedback.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[nikw9944]

Applied the same cross-cutting review feedback that landed on the sibling DZ Ledger skill (malbeclabs/doublezero#3991), adapted to this repo's bytemuck zero-copy model:

• Severity & voice section (blocking vs nit vs follow-up; frame judgment calls as questions, give exact replacement code, prove serialization claims with a runnable #[test]).
• Sibling-processor parity class — diff a new handler against its closest sibling for drift in account-loading, authority gating, status/journal handling, and counter discipline.
• Heap-cap hazard — a diff-grown account collection needs its cap enforced at the mutating instruction (+ near-cap test), or an over-grown account bricks on the 32KB heap.
• Hardcoded program id — an owner check's expected id must be an in-repo constant, never a caller-supplied arg/account.
• Off-chain RPC/tx hygiene — no unwrap/expect on RPC data, blockhash inside send, get_multiple_accounts, pre-flight existence checks, no zero-value txs, CU limit from real costs.
• Test realism — reach state via real instruction sequences (not set_*/byte-poke); flag feature-gated tests CI never runs.

Skipped the DZ-Ledger-specific items (the try_from-isn't-an-owner-check note, the arithmetic converse, and eyre/_info) since they don't apply to this repo's model. Reviewer-added checks are marked (reviewer-curated).