feat: package SkillSpector as a Codex skill

[edjshen]

What changed

• packages SkillSpector as a reusable Codex skill-scanner skill
• adds the skill contract in SKILL.md, OpenAI UI metadata, and a portable launcher
• runs the repository's locked production environment through uv --frozen --no-dev
• defaults guidance to static --no-llm inspection and preserves scanner exit codes

Why

This makes the existing SkillSpector engine directly usable as an agent skill while keeping target skills untrusted and avoiding execution of their scripts or dependencies.

Validation

• skill-creator quick_validate.py: valid
• launcher --help: successful against SkillSpector 2.9.4
• safe fixture: exit 0, score 0, SAFE, 0 findings
• malicious fixture: exit 1, score 93, CRITICAL / DO_NOT_INSTALL, 6 findings
• branch reconciled cleanly with upstream main at SkillSpector 2.9.4

Static --no-llm mode intentionally reports disabled semantic analyzers as a limitation; the launcher does not hide that completeness signal.