feat: vendorizar as 10 skills do pilar de seguranca em skills/

Copia local (nao fork, nao submodule) de safedeps, sca-audit,
secrets-scan, code-review-security, api-security-review,
web-security-review, cve-triage, patch-prioritization,
dependency-scanning e hermaguard -- commit exato de origem e licenca
de cada uma em skills/NOTICE.md. Elimina o passo de clone externo
pro pilar de seguranca do wf-security-review: git clone deste repo
ja traz tudo funcional.

Corrige tambem o comando de instalacao pro Claude Code nos dois
READMEs e no docs/SKILLS.md: Claude Code exige um diretorio por
skill (skills/<nome>/SKILL.md), nao aceita os .md soltos que o
comando antigo copiava -- confirmado testando a instalacao real.

skills/hermaguard/tools/hermaguard-benchmark/bugs/011-race-balance/code/app.py

@@ -0,0 +1,6 @@
+def withdraw(conn, user_id: int, amount: int):
+    row = conn.execute("SELECT balance FROM accounts WHERE id = ?", (user_id,)).fetchone()
+    if row[0] < amount:
+        raise ValueError("insufficient funds")
+    conn.execute("UPDATE accounts SET balance = balance - ? WHERE id = ?", (amount, user_id))
+    conn.commit()

skills/hermaguard/tools/hermaguard-benchmark/bugs/011-race-balance/ground-truth.json

@@ -0,0 +1,17 @@
+{
+  "title": "TOCTOU race on balance check",
+  "description": "Check-then-deduct without lock or atomic update; concurrent requests double-spend.",
+  "severity": "HIGH",
+  "category": "concurrency",
+  "findings": [
+    {
+      "file": "app.py",
+      "trigger": "balance check and deduct are separate non-atomic statements",
+      "description": "Double-spend under concurrent requests",
+      "severity": "HIGH",
+      "classes": [
+        "CWE-362"
+      ]
+    }
+  ]
+}

skills/hermaguard/tools/hermaguard-benchmark/bugs/011-race-balance/pre.diff

@@ -0,0 +1,11 @@
+--- a/app.py
++++ b/app.py
+ def withdraw(conn, user_id: int, amount: int):
+     row = conn.execute("SELECT balance FROM accounts WHERE id = ?", (user_id,)).fetchone()
+-    # single atomic guarded update
+-    cur = conn.execute("UPDATE accounts SET balance = balance - ? WHERE id = ? AND balance >= ?", (amount, user_id, amount))
+-    if cur.rowcount == 0:
+-        raise ValueError("insufficient funds")
+-    conn.commit()
+-    return
+     if row[0] < amount: