Add @probo/skills multi-agent compliance package

Ship compliance skills and agent plugin wiring for Claude Code,
Codex, OpenCode, and Cursor via Probo MCP (OAuth 2.0). Includes
access-review and missing-signatures workflows, repo-root Git
marketplaces, validation, and npm release CI.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

.github/workflows/release-npm-skills.yaml

@@ -0,0 +1,98 @@
+name: "Release skills"
+
+on:
+  push:
+    tags:
+      - "@probo/skills/v*"
+
+permissions:
+  contents: "read"
+
+jobs:
+  publish:
+    name: "publish"
+    runs-on: "ubuntu-latest"
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    steps:
+      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6
+        with:
+          fetch-depth: 0
+          submodules: recursive
+      - uses: "actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e" # v6
+        with:
+          node-version-file: ".nvmrc"
+          cache: "npm"
+          registry-url: "https://registry.npmjs.org"
+          scope: "@probo"
+      - run: "npm install -g npm@^11.8.0"
+      - run: "npm ci"
+      - name: "Verify package.json version matches tag"
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME##*/v}"
+          PKG_VERSION="$(node -p "require('./packages/skills/package.json').version")"
+          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
+            echo "tag version ($TAG_VERSION) does not match package.json version ($PKG_VERSION)" >&2
+            exit 1
+          fi
+      - run: "npm --workspace @probo/skills run validate"
+      - uses: "anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610" # v0.24.0
+        with:
+          path: ./packages/skills
+          format: cyclonedx-json
+          output-file: packages/skills/sbom.json
+      - uses: "anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2" # v7.4.0
+        with:
+          path: ./packages/skills
+          fail-build: true
+          severity-cutoff: critical
+      - name: "Generate checksums for published files"
+        run: |
+          cd packages/skills
+          find .claude-plugin skills commands agents hooks bin -type f 2>/dev/null \
+            | sort \
+            | while read -r file; do
+              echo "$(sha256sum "$file" | head -c 64)  $file"
+            done > checksums.txt
+          test -s checksums.txt
+      - run: "npm --workspace @probo/skills publish --access public --dry-run"
+      - run: "npm --workspace @probo/skills publish --access public"
+      - uses: "actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e" # v4
+        with:
+          subject-path: "packages/skills/**"
+          sbom-path: "packages/skills/sbom.json"
+      - uses: "actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32" # v4
+        with:
+          subject-path: "packages/skills/**"
+      - name: "Extract release notes"
+        run: |
+          VERSION="${GITHUB_REF_NAME##*/v}"
+          awk -v ver="$VERSION" '
+            /^## \[/ { if (found) exit; if ($0 ~ "\\[" ver "\\]") found=1 }
+            found
+          ' packages/skills/CHANGELOG.md > release-notes.md
+      - name: "Create GitHub release"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PRERELEASE_FLAG=""
+          if echo "${GITHUB_REF_NAME}" | grep -qE '(alpha|beta|rc)'; then
+            PRERELEASE_FLAG="--prerelease"
+          fi
+
+          gh release delete "${GITHUB_REF_NAME}" --yes 2>/dev/null || true
+
+          gh release create "${GITHUB_REF_NAME}" \
+            --title "${GITHUB_REF_NAME}" \
+            --notes-file release-notes.md \
+            $PRERELEASE_FLAG \
+            packages/skills/sbom.json packages/skills/checksums.txt
+      - uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7
+        with:
+          name: "skills-sbom"
+          path: |
+            packages/skills/sbom.json
+            packages/skills/checksums.txt
+          retention-days: 30