Add Security scan for AI agent skills

[danielholanda]

Summary

Adds a CI workflow (.github/workflows/skillspector.yml) that statically scans
every skill under skills/ with SkillSpector
to catch malicious patterns and security risks before merge.

• Static-only (--no-llm): no API key, runs isolated via uvx, pinned to
  commit 939da7d.
• Gating: fails a skill's check when it scores HIGH/CRITICAL (risk score > 50).

Mirrors validate.yml's discover → matrix → aggregate-gate pattern, so each
skill is its own pass/fail and the single SkillSpector security scan job can
be marked required in branch protection.

Triggers: PRs touching skills/** or the workflow import file, pushes to main, and
manual dispatch.