Add pre-commit hook, GitHub Actions workflow, and community templates

[ckdash-git]

Closes #72

Summary

Adds CI/CD integration support: a pre-commit hook definition and a GitHub
Actions workflow, so downstream projects can scan AI agent skills automatically
before commits and on every PR — without needing an LLM API key.

Changes

• .pre-commit-hooks.yaml: pre-commit hook definition (static scan, no API key)
• .github/workflows/skillspector.yml: GitHub Actions workflow with SARIF upload
• .github/PULL_REQUEST_TEMPLATE.md: contributor checklist for all future PRs
• .github/ISSUE_TEMPLATE/: structured bug and feature templates
• README.md: new CI/CD Integration section with usage examples

Testing

• make test passes (no Python changes, no tests affected)
• make lint passes
• Workflow YAML validated with actionlint (or GitHub's built-in check)

Checklist

• SPDX license comment added to workflow YAML header
• Commits signed off (git commit -s)

[rng1995]

The issue/PR/bug/feature templates are great, and the documented pre-commit + Actions usage is genuinely useful for downstream consumers. Two things about the active CI workflow and the hook need attention before merging, because as written they affect this repository directly.

1. The committed workflow will scan this repo and very likely fail its own CI (blocking). .github/workflows/skillspector.yml runs skillspector scan . --no-llm over the entire repository root and then fails the job when the risk score exceeds 50. This repository's own source intentionally contains malicious-pattern signatures, jailbreak example strings, and deliberately-malicious test fixtures — a static scan of . is very likely to exceed that threshold, so the Check scan result step would exit 1 on every push/PR to main. Please scope the scan to a dedicated example/target directory (or exclude src/ and the tests/ fixtures), or keep this as a copy-paste template in the docs rather than an active workflow on this repo.

2. pip install skillspector installs the published package, not the code under review. For this repo's own CI that won't exercise the PR's changes (and the step fails entirely if the package isn't published under that name on PyPI). Consider pip install . (or -e .) for the in-repo workflow, keeping pip install skillspector only in the copy-paste template for downstream users.

3. Verify the pre-commit hook passes a scan target. .pre-commit-hooks.yaml uses entry: skillspector scan with args: [--no-llm] and pass_filenames: false, so the effective invocation is skillspector scan --no-llm with no path argument. Unless scan defaults its input to the current directory, the hook will error on every commit. If scan requires a path, add one (e.g. .) to args.

Minor / optional:

• The ## Testing checklist in the PR description is unchecked — confirming actionlint passes on the workflow would be worth doing.

The templates themselves are good to go; these points are specifically about the workflow/hook behaviour.