docs(skills): structure private security advisory reports #4871

User Story

I review security reports submitted to OpenShell and need a consistent advisory format so I can identify affected deployments, reproduce a claim, and distinguish verified results from assumptions without reconstructing each report.

Description

Add a contributor skill for preparing structured vulnerability reports and creating authorized private GitHub advisory drafts. Include a reusable description template and guidance for affected-product metadata, evidence, reproduction, severity, remediation, and migration risks.

Context

Reports vary in structure and often leave deployment prerequisites, tested revisions, or verification status unclear. The existing security review workflow should consume the same information and support GHSA URLs directly. Follow the repository's disclosure policy and use only generic guidance and reusable templates in the source tree.

Definition of Done

• Add a discoverable internal create-security-advisory skill with a reusable report template.
• Separate demonstrated impact, code-inspection evidence, unverified claims, and concrete open questions.
• Explain private draft creation, metadata consistency, duplicate checks, and verification of the created draft.
• Update the security review skill, contributor inventory, and skill maintenance map.
• Validate Markdown, skill metadata, links, and public/internal skill discovery.