Add @probo/skills multi-agent compliance package

Ship compliance skills and agent plugin wiring for Claude Code,
Codex, OpenCode, and Cursor via Probo MCP (OAuth 2.0). Includes
access-review and missing-signatures workflows, repo-root Git
marketplaces, validation, and npm release CI.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

contrib/claude/release/README.md

@@ -1,6 +1,6 @@
 # Release
 
-The repository ships eight independently-versioned tracks. Each has its own
+The repository ships nine independently-versioned tracks. Each has its own
 version source, its own `CHANGELOG.md`, its own tag pattern, and its own
 release workflow. Cutting a release means: bump the version, write a
 changelog entry, commit, tag, push.
@@ -14,6 +14,7 @@ changelog entry, commit, tag, push.
 | `probo-agent`           | `probo-agent/v*`               | [probo-agent.md](./probo-agent.md) |
 | `@probo/n8n-nodes-probo` | `@probo/n8n-nodes-probo/v*`   | [n8n-nodes-probo.md](./n8n-nodes-probo.md) |
 | `@probo/cookie-banner`  | `@probo/cookie-banner/v*`      | [cookie-banner.md](./cookie-banner.md) |
+| `@probo/skills`         | `@probo/skills/v*`             | [skills.md](./skills.md)           |
 | Helm chart (`probo`)    | `helm/v*`                      | [helm.md](./helm.md)                   |
 
 When the user asks for a release **without specifying a track**, follow
@@ -76,6 +77,10 @@ git log $(git describe --tags --abbrev=0 --match='@probo/n8n-nodes-probo/v*')..H
 git log $(git describe --tags --abbrev=0 --match='@probo/cookie-banner/v*')..HEAD --oneline \
   -- packages/cookie-banner
 
+# @probo/skills
+git log $(git describe --tags --abbrev=0 --match='@probo/skills/v*')..HEAD --oneline \
+  -- packages/skills
+
 # helm chart
 git log $(git describe --tags --abbrev=0 --match='helm/v*')..HEAD --oneline \
   -- contrib/helm

contrib/claude/release/skills.md

@@ -0,0 +1,31 @@
+# Release `@probo/skills`
+
+After confirming commits below, follow the
+[common steps](./README.md#3-common-steps-every-track).
+
+## Track facts
+
+- **Tag pattern**: `@probo/skills/v*`
+- **Version source**: `packages/skills/package.json`
+- **Version bump**: `npm --workspace @probo/skills version <X.Y.Z> --no-git-tag-version`
+- **Validate**: `npm --workspace @probo/skills run validate`
+- **Changelog**: `packages/skills/CHANGELOG.md`
+- **Files to stage**: `packages/skills/package.json`,
+  `packages/skills/CHANGELOG.md`, `package-lock.json`
+- **Workflow**: `.github/workflows/release-npm-skills.yaml`
+- **Path filter**: `packages/skills`
+
+## Detect commits
+
+```shell
+git log $(git describe --tags --abbrev=0 --match='@probo/skills/v*')..HEAD --oneline \
+  -- packages/skills
+```
+
+If empty or non-user-facing only, do not release this track.
+
+## Notes
+
+There is no build step. Run `validate` after the version bump to catch manifest
+or structural errors before tagging. CI runs the same validation, publishes to
+npm with provenance + SBOM, and creates a GitHub Release.