fix: adopt progressive disclosure for sast-sca-security-analyzer and modularize audit-integrity 🤖🤖🤖

[burakkaygusuz]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

Refactors sast-sca-security-analyzer.agent.md and the audit-integrity skill using Progressive Disclosure Architecture:

1. Token & Prompt Density Optimization:

   • Reduces sast-sca-security-analyzer.agent.md from 426 lines (~24.6 KB / ~7,500 upfront tokens) down to 137 lines (~8.1 KB / ~1,500 upfront tokens), yielding an ~80% reduction in initial prompt overhead.
   • Decomposes static language flaw patterns, SCA supply chain rules, compliance criteria, and output templates into modular on-demand reference documents under skills/audit-integrity/references/.

2. Skill Modularity & Standards Compliance:

   • Creates 4 dedicated reference guides (sast-detection-patterns.md, sca-supply-chain-rules.md, policy-compliance-matrix.md, security-report-template.md).
   • Updates skills/audit-integrity/SKILL.md to register all 11 component references in accordance with the Agent Skills Specification.
   • Enforces ASD-STE100 Simplified Technical English across all procedural and descriptive sections.
   • Removes obsolete handoffs and non-standard model fields.

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify):

---

Additional Notes

• Passes all validation suites: npm run skill:validate (418 skills valid) and npm run plugin:validate (99 plugins valid).
• Generated category documentation updated via npm start.

[github-actions]

🔒 PR Risk Scan Results

Scanned 13 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	0
ℹ️ Info	0

✅ No matching risk patterns were detected in changed files.

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🔍 Vally Lint Results

⚠️ Warnings or advisories found

Scope	Checked
Skills	1
Agents	1
Total	2

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	1

Summary

Level	Finding
ℹ️	Vally currently lints SKILL.md content. Agent files were detected but skipped:

Full linter output

### Linting skills/audit-integrity
✅ audit-integrity (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

### Agent files detected (not linted by vally)
ℹ️ Vally currently lints SKILL.md content. Agent files were detected but skipped:
agents/sast-sca-security-analyzer.agent.md