feat: add SAST/SCA Security Analyzer agent and audit-integrity skill

[vijay-kr-bandi]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, or workflow file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, or workflow with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the staged branch for this pull request.

---

Description

This PR adds two related contributions:

Agent — sast-sca-security-analyzer
A specialized AppSec agent that performs enterprise-grade Static Application Security Testing (SAST) and Software Composition Analysis (SCA). It detects CWE-mapped security flaws with file/line precision across C#, JavaScript/TypeScript, Python, Java, and PowerShell codebases using taint-flow analysis, and audits dependency manifests for CVEs, license risk, and supply chain threats. Produces structured reports with policy compliance evaluation (OWASP Top 10 2025, PCI-DSS v4.0, NIST SP 800-53, GDPR). References the bundled audit-integrity skill for shared quality gate enforcement.

Skill — audit-integrity
A reusable shared integrity framework for security analysis agents. Provides 7 components: Clarification Protocol, Anti-Rationalization Guard, Self-Critique Loop, Retry Protocol, Non-Negotiable Behaviors, Self-Reflection Quality Gate (1–10 scoring, ≥8 threshold), and a Self-Learning System with lesson/memory governance templates. Designed to be extended by any AppSec agent (threat modelers, code review agents, SAST/SCA agents).

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• Update to existing instruction, prompt, agent, plugin, skill, or workflow.
• Other (please specify):

---

Additional Notes

The audit-integrity skill is designed to be reused by any future threat modeling or code quality agents contributed to this repo.
README.agents.md and README.skills.md were regenerated via npm run build.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

⚠️ This PR targets main, but PRs should target staged.

The main branch is auto-published from staged and should not receive direct PRs.
Please close this PR and re-open it against the staged branch.

You can change the base branch using the Edit button at the top of this PR,
or run: gh pr edit 1458 --base staged

[vijay-kr-bandi]

⚠️ This PR targets main, but PRs should target staged.

The main branch is auto-published from staged and should not receive direct PRs. Please close this PR and re-open it against the staged branch.

You can change the base branch using the Edit button at the top of this PR, or run: gh pr edit 1458 --base staged

Done