security-audit 2

Provider plugin for dsh-skill-pack-security: registers the pack's skills/ (zh) or skills-en/ (en) edition on ctx.skills AND the plugin_vet supply-chain gate tool on ctx.tools (license/SBOM/commit-lock/malware scans + five-dimension risk card). Ships both

Deterministic fact producers for security auditing: which deleted code came from a security fix, and which changed symbols no test ever executed.