feat: add security red-team audit workflow

[bglglzd]

What changed

• Added a tool-neutral Security Red-Team Audit & Remediation prompt.
• Added the matching Codex skill and plugin starter prompt.
• Covered authorized threat modeling, source review, safe dynamic checks, Burp Suite boundaries, rate limits, remediation, regression tests, and security reporting.

Safety model

The workflow defaults to source-only/passive review when authorization is unclear. Active testing is restricted to explicitly approved local or staging scope, supplied test accounts, and a hard request budget. It prohibits destructive testing, credential attacks, data exfiltration, and unapproved targets.

Validation

• python scripts/validate_skills.py
• Official skill validator for all four skills
• Plugin manifest validator
• Prompt/skill parity check
• git diff --check