feat(skills): add FIPS 199 categorization review - #506

Summary

Adds one experimental security skill that reviews draft FIPS 199 categorization records for information-type coverage, CIA rationale, tailoring traceability, and reproducible high-water-mark calculations. It does not approve a categorization, boundary, or authorization decision.

Eligibility & Accountability

• I am a federal employee or contractor.
• I understand this change and can explain it in my own words.
• I have the right to release this work under CC0-1.0.

AI Assistance Disclosure

• AI tools were used in this contribution.

OpenCode drafted a public-safe skill from the cited public standards and regenerated repository indexes.

• I verified AI-generated content and citations.
• No inherited or reused third-party material is represented as public domain.

Pattern Information

Pattern ID: fips-199-categorization
Pattern Type: skill
Status: experimental
Owners: @JJediny

Testing

• Ran validator, index generation, index checks, and unsafe-shell scan.
• Examples/output are public-safe and contain no system evidence.

Safety Checklist

• No secrets, PII, CUI, internal URLs, hostnames, customer data, or proprietary information.
• Output contract defines prohibited content.

Security Skill Checklist

• This PR adds one security skill.
• Deny-by-default governance frontmatter is set.
• No scripts or prompt bodies were copied from public sources.
• Public-source intake record is below and recorded in frontmatter.
• needs-human-review label applied and human security review requested.

Public Source Intake

intake:
  skill_id: fips-199-categorization
  source:
    name: FIPS PUB 199 and NIST SP 800-60 Volume I
    url: https://csrc.nist.gov/pubs/fips/199/final
    license: public-domain
    type: docs
  reviewed_by: "@JJediny"
  review_date: "2026-10-19"
  concepts_used: |
    CIA objectives, provisional information-type impacts, documented tailoring, and objective-level high-water marks.
  content_NOT_imported: |
    No scripts, prompts, skill text, agency forms, or system-specific categorization content were copied.
  scripts_present_in_source: no
  network_assumptions: |
    The skill is read-only and denies network access. Citations are references for human review.
  safety_concerns: |
    The skill excludes sensitive assessment evidence and does not approve categorization outcomes.
  license_concerns: |
    Public-domain federal sources; no source text was copied.
  decision: adopt-as-inspiration
  decision_notes: |
    The public standards establish the concepts; this contribution is an independently authored review procedure.

Validation Results

48/48 files passed validation
All validators passed
unsafe-shell scan: 0 error(s), 0 warning(s)

Additional Context

This PR deliberately adds one focused, read-only review skill. It does not include agency workflows, source assessment artifacts, or final-determination logic.