feat: vendorizar as 10 skills do pilar de seguranca em skills/

Copia local (nao fork, nao submodule) de safedeps, sca-audit,
secrets-scan, code-review-security, api-security-review,
web-security-review, cve-triage, patch-prioritization,
dependency-scanning e hermaguard -- commit exato de origem e licenca
de cada uma em skills/NOTICE.md. Elimina o passo de clone externo
pro pilar de seguranca do wf-security-review: git clone deste repo
ja traz tudo funcional.

Corrige tambem o comando de instalacao pro Claude Code nos dois
READMEs e no docs/SKILLS.md: Claude Code exige um diretorio por
skill (skills/<nome>/SKILL.md), nao aceita os .md soltos que o
comando antigo copiava -- confirmado testando a instalacao real.

README.md

@@ -72,6 +72,8 @@ Workflows load these skills by context. The three pillars of the security review
 
 ### 🛡️ Security review: the three pillars
 
+_Vendored under `skills/` — see [`skills/NOTICE.md`](skills/NOTICE.md) for exact origin and license._
+
 | Skill | What it does | Owner |
 |---|---|---|
 | [`safedeps`](https://github.com/Jeneidi/safedeps) | Queries OSV.dev in real time; returns CVE + severity + fixed version for a `package@version`. Covers the gap a frozen model can't. | [Jeneidi](https://github.com/Jeneidi) |
@@ -80,6 +82,8 @@ Workflows load these skills by context. The three pillars of the security review
 
 ### 🛡️ Security review: supporting skills
 
+_Also vendored under `skills/`._
+
 | Skill | What it does | Owner |
 |---|---|---|
 | [`secrets-scan`](https://github.com/OWASP/secure-agent-playbook) | Finds hardcoded credentials / API keys in code and git history. | [OWASP](https://github.com/OWASP) |
@@ -133,13 +137,18 @@ Workflows load these skills by context. The three pillars of the security review
 # Hermes Agent:
 cp workflows/*.md ~/.hermes/skills/software-development/
 
-# Claude Code / any skills-dir agent:
-mkdir -p ~/.claude/skills && cp workflows/*.md ~/.claude/skills/
+# Claude Code: each skill needs its own directory (won't load a loose .md)
+mkdir -p ~/.claude/skills
+for f in workflows/*.md; do
+  name=$(basename "$f" .md)
+  mkdir -p "$HOME/.claude/skills/$name"
+  cp "$f" "$HOME/.claude/skills/$name/SKILL.md"
+done
 
-# 2. (Optional, for security review) install safedeps + the OSV checker
-git clone --depth 1 https://github.com/Jeneidi/safedeps.git
-cp -r safedeps/skills/safedeps ~/.hermes/skills/safedeps
-cp safedeps/check_deps.py ~/.hermes/skills/safedeps/
+# 2. (Optional, for security review) the supporting skills are already
+# vendored in skills/ -- no external clone needed, just copy (Hermes; for
+# Claude Code use the same loop as step 1, swapping "workflows" for "skills"):
+cp -r skills/* ~/.hermes/skills/
 
 # 3. Use it
 # "review this PR for security"  -> wf-security-review loads