Align plugin-review criteria with local-exec risk tag

I noticed a small spec/reviewer drift while checking the Base MCP plugin review flow.

`skills/base-mcp/references/plugin-spec.md` defines `local-exec` as a valid risk tag for plugins that run third-party code locally, especially local MCP servers or CLI packages. The same spec also says local MCPs should carry `risk: [local-exec]` and explain the local execution boundary.

However, `.claude/skills/plugin-review/references/evaluation-criteria.md` still lists valid `risk` tags as `{liquidation, slippage, low-liquidity, pii, irreversible}` and omits `local-exec`.

This can make the review skill either flag a correct `local-exec` tag as invalid or miss a local-execution safety check during plugin review.

Suggested small fix:

- Add `local-exec` to the risk enum in `evaluation-criteria.md`.
- Add a short Security checklist item for local MCP / `cliPackage` paths: pinned versions, env var names only, no secret values, shell-less surfaces stop clearly, and `## Risks & Warnings` explains local third-party code execution.

Happy to open a narrow docs-only PR if that direction is useful.

Compare the risk-tag definition in skills/base-mcp/references/plugin-spec.md with .claude/skills/plugin-review/references/evaluation-criteria.md. Update the latter to include local-exec and the requested local MCP/cliPackage security checks. Done when the criteria align with the spec and clearly cover pinned versions, environment-variable names, shell-less surfaces, and the local execution warning.

Written by the indexing model from the issue text.