[OdevMatheus]

Closes #190

Summary

• Adds deterministic security scanner (\src/auditor/security.ts) with \�uditSkillSecurity\ and \�uditCatalogSecurity\ exported from \src/auditor/index.ts.
• Blocks outbound network/exfiltration clients (\urllib.request, \http.client, \socket,
  equests, \httpx, \�iohttp, \tplib, \smtplib, \ elnetlib, \paramiko, \websocket, \websockets), dynamic execution/deserialization (\eval, \exec, _import_, \pickle, \marshal, \shelve, \ctypes, \cffi), and unsafe shell execution (\os.system, \os.popen, \pty, \subprocess\ with \shell=True, remote pipe-to-shell \curl | sh, and reverse shells).
• Eliminates false positives on legitimate large/famous skills (\urllib.parse, \http.server, \webbrowser, \rom re import compile, \def eval(), JS class \�sync eval()\ methods, and local \curl\ healthchecks).
• Wires the catalog script security gate into .github/workflows/ai-ci.yml.