feat(skills): add HOL Guard runtime security skill

[kantorcodes]

Summary

Adds HOL Guard as a first-class security skill in the Agents Inc marketplace.

The new shared-security-hol-guard package follows the repository's current skill structure and directly covers:

• isolated hol-guard installation and status/detection checks
• Guard-owned Claude Code and other local harness protection flows
• explicit approval review and resolution
• receipts, inventory, events, and other evidence commands
• the separate plugin-scanner install and package verification flow
• fail-closed guidance for missing, non-zero, timeout, or malformed Guard results

The content is based on the maintained HOL Guard skill and current upstream commands, while matching the existing Agents Inc security/AI/CLI skill conventions.

Validation

• Exact upstream issue/PR dedupe for HOL Guard / hol-guard was clean immediately before submission.
• Re-read both committed files from the fork branch after the write.
• Metadata uses an existing shared-security category, shared domain, and author @kantorcodes.
• Repository CI remains the source of truth for bun run format:check and bun run validate; no local CI-pass claim is made because the available sandbox did not complete the repository toolchain install.

Scope

Two new files only under src/skills/shared-security-hol-guard/. No generated marketplace artifacts or unrelated files are changed.