feat(skill): core SKILL.md integration (#7)

[andybaran]

Closes #7.

[andybaran]

🔬 Code review (code-review agent)

Verdict: APPROVED (after one revision round).

First pass raised 2 issues, both now fixed & re-verified:

1. Important — references/security.md push-protection command switched from -f (stringified object → 422) to a proper nested JSON object via --input - heredoc, matching branch-protection.md. Now succeeds.
2. Minor — SKILL.md Step 3.5 now instructs deleting .gitflow-review-package.txt before git add -A in the re-review loop, closing the accidental-commit gap.

Verified: scope limited to the 5 permitted files; frontmatter valid YAML (version: 1.1, allowed-tools, compatibility); documented commands match real gitflow.sh subcommands; CI check context (Validate skill) is real; all 18 intra-repo links resolve; evals.json parses with new scenarios (code-review verdict, CI gate, secret refusal, branch-protection consent). Non-negotiables, Step 0 offer-with-consent, Step 3.5 blocking review, Step 4 CI gate + revert rollback, worktrees, DoD, Quick reference all present.

Human orchestrator performing final squash-merge.