chore(skills): package CI and security advisory skills - #37

Linked issue

Refs #15

Nonclosing reference. U1 is the first bounded package-completeness slice; this PR does not finish #15 or the whole B01 block. Workflow assets, execution safety and their runtime/dependency contracts remain separate planned units.

PR type

• Maintenance/tooling (type:chore)

Summary

• Package two reviewed advisory skills: github-ci-advisor and repository-security-review, with local references and cross-links.
• Register exactly those two alongside bootstrap, add explicit nonautomatic handoffs, and document the source-tree versus existing release-tag distinction.
• Add eight structural checks without changing runtime, schema, templates, defaults, CI/CD, permissions or version.

Changes

Scope: 10 files, 374 additions + 1 deletion = 375 changed lines. Base main d38d865debc69f5818c4c93007270d7745c0d1e6; head 054470bc541c5681735785eb960e63a8bf337929; candidate tree 04879a5b8407f2422a0c6b86b1939211ae463b19. The isolated transport matches the reviewed candidate byte-for-byte. Package identity, private: true, version 1.1.0 and portable test command are unchanged. Published CI pins, inventory, safe actionlint wrapper, mandatory scanner fixtures, three-OS matrix, required test gate and release body are byte-preserved.

Test plan

• Genuine registration/handoff RED: after adding skill files and tests, before wiring, focused suite 6 pass / 2 assertion failures. Missing-file/import failures are not claimed as RED. GREEN: 8/8.
• Full local suite: 77/77 (69 baseline + eight advisor checks); dedicated Gitleaks fixtures 4/4 and actionlint fixtures 4/4, no skips. Approved binaries 8.30.1 / 1.7.12; modified-source inventory lint exits 0.
• Offline local pack from immutable candidate tree, not the dirty worktree: 35 files, all byte-equal to Git/source, no symlinks/traversal/cache or credential entries, SHA-1/SHA-512 match metadata. SHA-256 228eda3325aab91ce01db804d38026f9cfc317a1fb9b7b128dd50937e412a989.
• Independent fresh extracted-package checks reproduce 77/77 + 4 Gitleaks + 4 actionlint. Gitleaks scan of the final extracted payload exits 0 with zero findings, using external config/ignore and full redaction; no reports uploaded.
• Agent contract smoke: one agent loaded both new SKILL.md files and references, proposed LEAVE current CI unchanged and returned bounded read-only security findings/limits, with no execution or mutations. This is not Pi startup/install/reload/trust verification.
• SHA-bound remote project Node v20.20.2 checks passed on 054470bc541c5681735785eb960e63a8bf337929: run 37862022195. Ubuntu 77 pass / 0 skip; macOS and Windows 75 pass / 2 inherited Linux descriptor skips each. All eight new advisor cases passed without skips on all three OSes. Both scanner archives passed SHA-256 verification; Gitleaks scanned 30 fetched-history commits with no findings, both fixture suites passed 4/4 without skips, inventory lint and aggregate test succeeded; release skipped.
• Windows initially exposed LF-only metadata assertions (run 37861516337). Local explicit CRLF reproduction: focused 7 pass / 1 assertion fail; strict LF/CRLF anchors plus both variants on every platform fixed it. Token budget still checks raw bytes; no global read normalization, skip, checkout/workflow change or relaxed name/license/author/version/quoted-description checks. Corrected local full and extracted-pack suites passed 77/77; independent correction verification passed.

Local execution used Linux Node 24.20.0. The remote project target remains Node 20. macOS/Windows retain the two inherited Linux descriptor skips; no new scanner skip path exists. Shellcheck is inapplicable: no shell/workflow code changed. Active LSP probe of the new .mjs test was inconclusive, not confirmed clean.

These tests verify structural contracts, not LLM runtime behavior, malware absence or infallible prompt-injection detection. Both advisory skills preserve approval boundaries. pi.skills controls package discovery; the local Gentle .atl registry is only a delegator cache, not a Pi loading prerequisite. Runtime Pi install/reload/trust is untested. The existing immutable v1.1.0 tag still points to its older bootstrap-only source; no version/tag is assigned or moved here.

Contributor checklist

• Approved open issue linked nonclosing.
• Exactly one existing type:* label (type:chore) confirmed by PR readback.
• Changed skills exercised in an agent contract smoke, with limitations stated.
• Package/docs updated and independent verification passed.
• Conventional commit; no Co-Authored-By trailer.
• Required target check test passed remotely on this exact head.

Draft for human review. No merge, automatic ready/issue closure, version change, tag, release, credential modification or CD change is included.