feat: vendorizar as 10 skills do pilar de seguranca em skills/

Copia local (nao fork, nao submodule) de safedeps, sca-audit,
secrets-scan, code-review-security, api-security-review,
web-security-review, cve-triage, patch-prioritization,
dependency-scanning e hermaguard -- commit exato de origem e licenca
de cada uma em skills/NOTICE.md. Elimina o passo de clone externo
pro pilar de seguranca do wf-security-review: git clone deste repo
ja traz tudo funcional.

Corrige tambem o comando de instalacao pro Claude Code nos dois
READMEs e no docs/SKILLS.md: Claude Code exige um diretorio por
skill (skills/<nome>/SKILL.md), nao aceita os .md soltos que o
comando antigo copiava -- confirmado testando a instalacao real.

skills/hermaguard/tools/hermaguard-benchmark/bugs/001-sql-injection/code/app.py

@@ -0,0 +1,8 @@
+import sqlite3
+
+def get_user_by_name(username: str):
+    conn = sqlite3.connect("users.db")
+    cur = conn.cursor()
+    query = f"SELECT * FROM users WHERE name = '{username}'"
+    cur.execute(query)
+    return cur.fetchone()

skills/hermaguard/tools/hermaguard-benchmark/bugs/001-sql-injection/ground-truth.json

@@ -0,0 +1,9 @@
+{
+  "title": "SQL injection in get_user_by_name",
+  "description": "Username interpolated into SQL via f-string; attacker-controlled input reaches the query unsanitised.",
+  "severity": "CRITICAL",
+  "category": "security",
+  "findings": [
+    {"file": "app.py", "trigger": "f-string SQL query username interpolation", "description": "SQL injection via unparameterised query", "severity": "CRITICAL", "classes": ["CWE-89"]}
+  ]
+}

skills/hermaguard/tools/hermaguard-benchmark/bugs/001-sql-injection/pre.diff

@@ -0,0 +1,10 @@
+--- a/app.py
++++ b/app.py
+@@ -2,6 +2,6 @@ import sqlite3
+ def get_user_by_name(username: str):
+     conn = sqlite3.connect("users.db")
+     cur = conn.cursor()
+-    cur.execute("SELECT * FROM users WHERE name = ?", (username,))
++    query = f"SELECT * FROM users WHERE name = '{username}'"
++    cur.execute(query)
+     return cur.fetchone()