referee2: split code protocol into phase-keyed sibling files

[nsmiller2501]

Summary

Follow-on to #11. Refactors /referee2 code mode by splitting code.md into a short orchestrator plus five phase-keyed sibling files. The deck mode is untouched.

What changed

• .claude/skills/referee2/code.md shrinks from ~790 lines to a short top-of-funnel file that lists the phases and points to each sibling file. The full prose for each phase moves to its own file.
• New sibling files:
  • code_protocol.md — the high-level Phase 0 / Phase 1 / Phase 2 ordering and what gates each transition.
  • code_subagent_prompts.md — the exact prompts handed to each subagent (Stata, Python, R, results-comparison) so the orchestrator stays a thin coordinator.
  • code_spec_outputs.md — the expected JSON / Markdown shapes for replication outputs.
  • code_tainted_session.md — the "stop and report" protocol for when the host session has accumulated context that would taint the audit.
  • code_reporting.md — the final report template and the criteria that govern severity.
• README.md updates the installation paragraph to mention the progressive-load pattern.

Why

• The code.md monolith was load-once-keep-loaded: every invocation paid the full token cost even when the audit had no reason to enter (for example) the tainted-session branch.
• The phased split lets the orchestrator pull in only the protocol it needs at each step (Phase 0 = ordering only; Phase 1 = subagent prompts; Phase 2 = reporting). The largest file (code_spec_outputs.md) is loaded only when results-comparison runs.
• deck mode wasn't large enough to benefit from the same treatment; it stays single-file.

Testing

• Walked through a small replication audit end-to-end against a recent project to confirm the orchestrator successfully loads each phase's sibling file at the right step and that nothing was dropped in the split.
• Verified code.md ↔ sibling-file cross-references all resolve.
• No behavior change in audit content or report output expected — this is a context/file-layout refactor only.