feat: vendorizar as 10 skills do pilar de seguranca em skills/

Copia local (nao fork, nao submodule) de safedeps, sca-audit,
secrets-scan, code-review-security, api-security-review,
web-security-review, cve-triage, patch-prioritization,
dependency-scanning e hermaguard -- commit exato de origem e licenca
de cada uma em skills/NOTICE.md. Elimina o passo de clone externo
pro pilar de seguranca do wf-security-review: git clone deste repo
ja traz tudo funcional.

Corrige tambem o comando de instalacao pro Claude Code nos dois
READMEs e no docs/SKILLS.md: Claude Code exige um diretorio por
skill (skills/<nome>/SKILL.md), nao aceita os .md soltos que o
comando antigo copiava -- confirmado testando a instalacao real.

skills/hermaguard/tools/hermaguard-benchmark/bugs/006-hardcoded-secret/code/app.py

@@ -0,0 +1,11 @@
+# Deliberately broken sample: a live-looking API key committed to source.
+# NOTE: the value is an obviously-fake placeholder (marker, not a real key
+# format) so secret scanners do not flag the corpus; the CWE-798 pattern
+# (credential hardcoded in source) is what the benchmark tests for.
+PAYMENT_KEY = "EXAMPLE-KEY-DO-NOT-USE-0123456789"
+
+def charge(card_token: str, amount: int):
+    import requests
+    return requests.post("https://api.example-payments.invalid/v1/charges",
+                         headers={"Authorization": f"Bearer {PAYMENT_KEY}"},
+                         data={"card": card_token, "amount": amount})

skills/hermaguard/tools/hermaguard-benchmark/bugs/006-hardcoded-secret/ground-truth.json

@@ -0,0 +1,17 @@
+{
+  "title": "Hard-coded API key committed to source",
+  "description": "Live API key embedded in source; anyone with repo access can use the account.",
+  "severity": "CRITICAL",
+  "category": "security",
+  "findings": [
+    {
+      "file": "app.py",
+      "trigger": "live API key assigned to module constant",
+      "description": "Credential theft and unauthorized charges from public repo",
+      "severity": "CRITICAL",
+      "classes": [
+        "CWE-798"
+      ]
+    }
+  ]
+}

skills/hermaguard/tools/hermaguard-benchmark/bugs/006-hardcoded-secret/pre.diff

@@ -0,0 +1,4 @@
+--- a/app.py
++++ b/app.py
+@@ -0,0 +1 @@
++ (new file — the bug is introduced by this change)