Summary

• Adds TechStackPHP detection via composer.json in repository classification
• Adds vigilante-issue-implementation-on-php skill with Composer, testing, static analysis, formatting, and security guidance
• Adds PHP security guidance (password hashing, input validation, serialization, secrets, dependency audit) injected into prompts for PHP repositories
• Adds mixed-language guidance when PHP repos coexist with Node.js or Go

Changes

• internal/repo/repo.go: TechStackPHP constant, detectPHPTechStack() function
• internal/skill/skill.go: VigilanteIssueImplementationOnPHP constant, registration, isPHPTarget() helper, selection logic
• internal/skill/security.go: phpSecurityGuidance() and 9 helper functions for PHP-specific guidance sections
• skills/vigilante-issue-implementation-on-php/SKILL.md: Full PHP skill instructions
• skills/vigilante-issue-implementation-on-php/agents/openai.yaml: Agent interface definition
• skillassets.go: Updated embed directive to include PHP skill

Test plan

• 3 new tests in repo_test.go for PHP detection (composer.json present, absent, PHP+Node.js dual detection)
• 11 new tests in skill_test.go for PHP skill selection, prompt content, non-PHP exclusion, mixed-language guidance, Go-over-PHP priority, monorepo-over-PHP priority
• Full test suite passes with no regressions (go test ./...)
• go vet ./... and gofmt clean

Closes #362