feat: add dev workflows as agent skills

Four SKILL.md-based workflows for agent-driven development: frontend/UI,
backend/API, architecture, and security code review.

Each workflow defines phases with verification steps, acceptance criteria
and hard rules so agents deliver work that can be checked instead of
asserted. The security review consults live sources (OSV.dev, GitHub
Advisory, NVD) because model CVE knowledge is frozen at training cutoff.

Includes a QA harness (qa/) that scores workflows on 30+ criteria, a
non-regression gate, and meta-tests that corrupt the harness to prove it
detects regressions.

qa/snapshots/baseline-final.json

@@ -0,0 +1,236 @@
+{
+ "workflows": [
+  {
+   "name": "wf-frontend",
+   "score": 385.5,
+   "skills_referenciadas": [
+    "animate",
+    "anti-ai-slop",
+    "avoid-ai-writing",
+    "claude-design",
+    "design-md",
+    "frontend-award-tier",
+    "frontend-design",
+    "hermaguard",
+    "html-css-print-engineer",
+    "pdf-generator",
+    "pdf-render-qa",
+    "pdf-visual-designer",
+    "popular-web-designs",
+    "professional-pdf-director",
+    "sketch",
+    "vercel-composition-patterns",
+    "vercel-react-best-practices",
+    "web-design"
+   ],
+   "criteria": {
+    "frontmatter": 5,
+    "when_to_use": 8,
+    "num_fases": 6,
+    "regras_duras": 10,
+    "n_regras": 9,
+    "fase1": 16,
+    "fase2": 16,
+    "fase3": 16,
+    "cobertura_fases": 20,
+    "skills_validas": 15,
+    "fase_rotulos": 6,
+    "fase_acao": 6,
+    "fase_revisao": 6,
+    "anti_slop": 4.5,
+    "cmd_blocos": 8,
+    "cmd_reais": 5,
+    "sec_criterios": 8,
+    "sec_verificar": 6,
+    "sec_nao_regressao": 6,
+    "tamanho": 8,
+    "testes_referidos": 5,
+    "passos_total": 30,
+    "verificacao_total": 24,
+    "comandos_reais": 20,
+    "profundidade": 10,
+    "por_fase_verif": 18,
+    "por_fase_cmd": 18,
+    "por_fase_antip": 12,
+    "por_fase_aceite": 12,
+    "exemplos": 10,
+    "exemplos_count": 12,
+    "artefatos": 14,
+    "fluxo": 8,
+    "entradas_saidas": 8
+   }
+  },
+  {
+   "name": "wf-backend",
+   "score": 424.0,
+   "skills_referenciadas": [
+    "api-security-review",
+    "auth-rbac-scaffold",
+    "bola-detector",
+    "dependency-cve-audit",
+    "fastapi-uvicorn-wiring",
+    "hermaguard",
+    "injection-checker",
+    "network-audit",
+    "openapi-hardener",
+    "rest-graphql-debug",
+    "secure-coding",
+    "security-best-practices",
+    "security-test-generator",
+    "software-code-quality",
+    "test-driven-development"
+   ],
+   "criteria": {
+    "frontmatter": 5,
+    "when_to_use": 8,
+    "num_fases": 8,
+    "regras_duras": 10,
+    "n_regras": 10,
+    "fase1": 15,
+    "fase2": 15,
+    "fase3": 16,
+    "fase4": 16,
+    "cobertura_fases": 20,
+    "skills_validas": 15,
+    "fase_rotulos": 6,
+    "fase_acao": 6,
+    "fase_revisao": 6,
+    "anti_slop": 5.0,
+    "cmd_blocos": 8,
+    "cmd_reais": 5,
+    "sec_criterios": 8,
+    "sec_verificar": 6,
+    "sec_nao_regressao": 6,
+    "tamanho": 8,
+    "testes_referidos": 5,
+    "passos_total": 30,
+    "verificacao_total": 24,
+    "comandos_reais": 20,
+    "profundidade": 13,
+    "por_fase_verif": 22,
+    "por_fase_cmd": 24,
+    "por_fase_antip": 16,
+    "por_fase_aceite": 16,
+    "exemplos": 10,
+    "exemplos_count": 12,
+    "artefatos": 14,
+    "fluxo": 8,
+    "entradas_saidas": 8
+   }
+  },
+  {
+   "name": "wf-architecture",
+   "score": 413.7,
+   "skills_referenciadas": [
+    "architecture-diagram",
+    "avoid-ai-writing",
+    "brainstorming",
+    "c4-architecture",
+    "excalidraw",
+    "hermaguard",
+    "isaqb-architecture-governance",
+    "secure-architecture-governance",
+    "security-threat-model",
+    "system-design",
+    "writing-plans"
+   ],
+   "criteria": {
+    "frontmatter": 5,
+    "when_to_use": 8,
+    "num_fases": 8,
+    "regras_duras": 10,
+    "n_regras": 10,
+    "fase1": 15,
+    "fase2": 16,
+    "fase3": 14,
+    "fase4": 16,
+    "cobertura_fases": 20,
+    "skills_validas": 11,
+    "fase_rotulos": 6,
+    "fase_acao": 0,
+    "fase_revisao": 6,
+    "anti_slop": 4.7,
+    "cmd_blocos": 8,
+    "cmd_reais": 5,
+    "sec_criterios": 8,
+    "sec_verificar": 6,
+    "sec_nao_regressao": 6,
+    "tamanho": 8,
+    "testes_referidos": 5,
+    "passos_total": 30,
+    "verificacao_total": 24,
+    "comandos_reais": 20,
+    "profundidade": 13,
+    "por_fase_verif": 24,
+    "por_fase_cmd": 24,
+    "por_fase_antip": 16,
+    "por_fase_aceite": 15,
+    "exemplos": 10,
+    "exemplos_count": 12,
+    "artefatos": 14,
+    "fluxo": 8,
+    "entradas_saidas": 8
+   }
+  },
+  {
+   "name": "wf-security-review",
+   "score": 390.0,
+   "skills_referenciadas": [
+    "api-security-review",
+    "auth-rbac-scaffold",
+    "bola-detector",
+    "code-review-security",
+    "cve-triage",
+    "dependency-cve-audit",
+    "hermaguard",
+    "injection-checker",
+    "patch-prioritization",
+    "safedeps",
+    "sca-audit",
+    "secrets-scan",
+    "security-threat-model",
+    "web-security-review"
+   ],
+   "criteria": {
+    "frontmatter": 5,
+    "when_to_use": 8,
+    "num_fases": 10,
+    "regras_duras": 10,
+    "n_regras": 8,
+    "fase1": 15,
+    "fase2": 16,
+    "fase3": 13,
+    "fase4": 15,
+    "fase5": 15,
+    "cobertura_fases": 20,
+    "skills_validas": 14,
+    "fase_rotulos": 6,
+    "fase_acao": 0,
+    "fase_revisao": 6,
+    "anti_slop": 5.0,
+    "cmd_blocos": 8,
+    "cmd_reais": 5,
+    "sec_criterios": 0,
+    "sec_verificar": 6,
+    "sec_nao_regressao": 6,
+    "tamanho": 8,
+    "testes_referidos": 5,
+    "passos_total": 30,
+    "verificacao_total": 24,
+    "comandos_reais": 16,
+    "profundidade": 15,
+    "por_fase_verif": 23,
+    "por_fase_cmd": 19,
+    "por_fase_antip": 12,
+    "por_fase_aceite": 5,
+    "exemplos": 0,
+    "exemplos_count": 12,
+    "artefatos": 14,
+    "fluxo": 8,
+    "entradas_saidas": 8
+   }
+  }
+ ],
+ "total": 1613.2,
+ "max": 400
+}