[vitormattos]

Summary

• Add handle-security-advisory to coordinate confidential GHSA triage, private-fork integration, supported-branch corrections, release verification, CVE tracking and approved publication.
• Add focused lifecycle and disclosure references with explicit human-action boundaries, reporter evidence preservation and support/EOL guidance.
• Integrate the workflow with the skill catalog, release handoff and author/DCO checks, and add sanitized evaluation scenarios.
• Update plugin metadata to version 0.8.0.

Why a separate skill

Security advisories have a distinct confidential-to-public transition and separate approvals for patch integration, releases and public disclosure. Ordinary PR review remains with review-pull-request; scoped fixes with execute-issue; CI failures with diagnose-ci-failure; routine releases continue through the project's existing release process. This skill does not replace them.

Verification

• python3 -m unittest discover -s tests -q — 17 tests passed.
• reuse lint — passed (59/59 files licensed).
• Skill packaging validator — passed for the new skill's portable bundle.
• New evaluation matrix includes negative controls for ordinary PRs, disclosure authorization, private-fork confusion, EOL branches, CVE asynchronous state and DCO identity drift. These are documented manual scenarios, not claimed executed model evaluations.

All four branch commits were generated with signed commits and matching DCO identity. No private vulnerability details, account-specific tooling or credentials are included.

Do not merge automatically.