feat: document agent security rules

[mattpartida]

Summary

• add stable ASG rule IDs to agent-security config findings
• document rule IDs and mitigations
• add SECURITY.md, CONTRIBUTING.md, and a sample high-risk audit report
• update README/SKILL references

Test plan

• python -m compileall -q skills tests
• python -m pytest -q
• ruff check .
• ./package-skills.sh