review config: raise the profile, and cover the paths with no instructions

[dcotelo]

Problem

.coderabbit.yaml has served four feature branches now, and its gaps are
visible in what got reviewed and what did not.

• profile: chill. At that level, feat(doctor): report a CLI older than the plugin, and a statusLine that is not ours #33 needed a second, explicitly requested
  full review to surface two defects the incremental pass had missed — one of
  them a classifier that ignored statusLine.type and so reported a broken
  configuration as correct.
• path_instructions cover scripts/** and tests/** only. Nothing covers
  docs/** (seven files after the README split), .github/** (where the
  release automation and a write-capable token live), statusline/**, or
  hooks/**.

Proposed behavior

• Raise reviews.profile to assertive.
• Add path instructions for the uncovered paths, each carrying the conventions
  that actually apply there:
  • docs/**: every documented command must exist, anchors must resolve, and no
    other statusline tool is named.
  • .github/**: actions pinned to a full commit SHA, and a workflow holding a
    write-capable token must not execute a script from the pull request's own
    revision.
  • statusline/** and hooks/**: never fail the session — a missing
    dependency or unreadable config prints nothing and exits 0.
• Consider auto_assign_reviewers: true so its review is visible as a review.

Alternatives considered

• Leaving chill and requesting a full review by hand on any branch that
  touches something delicate. Works — it is what caught the statusLine.type
  defect — but it depends on remembering.
• Raising the profile only for some paths. Not supported; profile is global.

Additional context

Surface: .coderabbit.yaml. No code change, no release.

Contrary to a reasonable first assumption, "turn on more linters" is already
done: actionlint, yamllint, markdownlint and gitleaks all default to
enabled, and listing only shellcheck under tools: has not disabled them.
Worth confirming they are actually firing, since the docs-only #32 drew no
markdown comments at all.