setup-repo: rules templates ship as TODO placeholders

[jonnyspicer]

Piloting in retina-tracker (#5): assets/rules/{security,code-style}.md are literal TODOs. A repo that runs the skill and stops inherits placeholder rules. Consider stack-aware default content or a post-scaffold prompt to fill them. Refs #5.