feature: add drift-detection custom agent and baseline skill

[hmandhadpocs]

Summary

Adds a production drift detection workflow — a custom agent paired with a companion skill that together
compare current AWS resource configurations against a defined operational baseline.

What's included

New Skill: skills/drift-detection-baseline/

Defines expected production state across three categories:

• Security posture — encryption at rest/transit, network isolation, public S3 access, exposed
  secrets
• Compliance — required tags, CloudTrail logging, AWS Config recording, backup retention
• Lifecycle — deprecated Lambda runtimes, end-of-support RDS engines, outdated EKS versions

Includes severity classification framework and AWS Config rule coverage gap analysis methodology.

New Custom Agent: custom-agents/drift-detection/

Orchestrates the drift detection workflow:

1. Loads the baseline skill for expected state definitions
2. Discovers resources via read-only API calls (use_aws tool)
3. Compares actual vs. expected configuration
4. Produces a drift detection report artifact
5. Creates/updates recommendations in the improvements backlog
6. Identifies Config rule gaps for automated enforcement

Other

• Updated llms.txt with new skill entry
• Added .kiro/settings/ to .gitignore

Testing

• Skill includes evaluation tests (5 functional scenarios + 5 negative trigger tests)
• Tested with DevOps Agent in an Agent Space

Checklist

• SKILL.md with valid frontmatter (name, description, metadata)
• README.md for both skill and custom agent
• CHANGELOG.md at version 1.0.0
• .skilleval.yaml with audit config
• evals/ with evals.json and eval_queries.json
• llms.txt updated
• No disallowed file extensions
• Read-only — no IAM permissions beyond AIDevOpsAgentAccessPolicy