Add PCI TPSP service coverage gates

[NiXouuuu]

Closes #1607.

Summary

• Add a TPSP responsibility and AOC service-coverage gate to PCI DSS scope reduction.
• Require provider/service match, data-flow proof, requirement-level responsibility ownership, customer-owned controls, provider-side drift review, and monitoring cadence before confirming SAQ impact.
• Add a Scope Reduction Not Proven classification and a TPSP/SAQ output section so provider evidence is reported separately from the requirement summary.
• Extend common pitfalls and prompt-injection guardrails for generic provider or contract claims.

Validation

• git diff --check
• Markdown fence-balance check for skills/compliance/pci-dss-review/SKILL.md
• Required marker check for TPSP service-coverage, evidence record, scope-reduction classification, SAQ output, provider drift, and service-specific AOC guardrails

Payment preference: PayPal; details can be provided privately after maintainer acceptance.