v3.17.0 - 10 ported discipline/security skills

v3.17.0

Ported 10 skills from a parallel Devin install, adapted to bundle conventions (skill_count 91 -> 101):

• powershell-safe, shell-safe: shell footgun traps (redirect BOM/truncation, empty-var rm, pipe exit codes)
• edge-cases: input/state/failure-mode enumeration before coding
• dead-wire: dead-feature audit (buttons, events, flags with no consumer)
• github-actions: CI security (SHA pinning, pull_request_target, OIDC, cache poisoning)
• webhooks: receiver discipline (signature verification, idempotency, fast-ack)
• typescript-node: strict-mode/async/npm footguns
• binary-triage: fast static evidence from closed binaries pre-Ghidra
• ghidra: validated headless workflow (Thumb/TMode, seeds, firmware)
• dma: stdlib-only scoped recon/probe toolkit (scope.md + 10 tools, gated invasive classes)

Issue

Closes #250 (milestone v3.17.0)

Verification

• audit.py: 32 checks, zero errors/warnings
• validate-skill-format.py: 251/251
• CI: 12/12 checks green (PR #251)