security-advisory skill: land GHSA fixes through ordinary public PRs, not private-fork merges #2880

Problem

The security-advisory skill (step 5, "Merging from the private fork") tells you to merge each fix from the advisory's private fork. That takes three workarounds:

• Required checks. Private forks run no Actions, so a fork PR can never satisfy v2/main's required DCO check or v1/main's required build check. The merge needs required_status_checks removed from the ruleset, which is an admin act on a protected branch, and then restored from a snapshot.
• Unchecked commits. The commits land without CI, so the DCO check and the gate have to be run on the fix branch by hand.
• All PRs at once. Merging an advisory merges all of its fork's PRs together (v2 and v1), which constrains merge order across advisories.

The fix commits become public at merge either way, so going through the fork buys no secrecy.

Proposal

Rewrite step 5 (and the matching pointer in the release skill's v1 section) to the flow used for v2.14.0 / 1.0.4:

1. Develop and review the fix in the private fork, as now.
2. Convert the GHSA draft card to an issue on Add tab and approval flow for server -> client sampling #28, with labels and the release milestone. For an advisory that affects both lines, also file the v1 issue on get tools working #11, cross-linked. Note the trade-off: the converted issue makes the card's title and body public before the advisory is.
3. Push the fork branch to the public repo under a standard name (v2/fix/<N>-<slug>, v1/fix/<N>-<slug>), and open an ordinary PR against v2/main / v1/main with Closes #N. Normal CI, the DCO check, the Copilot loop and normal merge rules apply. No ruleset changes.
4. Merge, close the issue and move the card to Done. Close the fork PRs unmerged.
5. Release on every affected line, then publish the advisory.

Step 6 ("After publication, turn the card into public tracking") then shrinks to editing the already-converted issue, if anything. AGENTS.md's GHSA-draft exception text says the card becomes public tracking "once the advisory is published", so it needs the same update.

Precedent: GHSA-h9j8-vj8g-v3gg (#2872 / PR #2875), GHSA-rwv7-mh2c-ff2p (#2873 / PR #2876), GHSA-2fw8-7jmw-r937 (#2874 / PR #2877, v1 #2878 / PR #2879).