feat(skills): add criticality evidence screening - #508

Summary

Adds one experimental security skill for reviewing preliminary system criticality evidence: mission consequences, dependency cascades, information/privilege concentration, and uncertainty. It does not designate an HVA or set FIPS, CUI, PII, or authorization status.

Eligibility & Accountability

• I am a federal employee or contractor.
• I understand this change and can explain it in my own words.
• I have the right to release this work under CC0-1.0.

AI Assistance Disclosure

• AI tools were used in this contribution.

OpenCode drafted a public-safe skill from the cited public source and regenerated repository indexes.

• I verified AI-generated content and citations.
• No inherited or reused third-party material is represented as public domain.

Pattern Information

Pattern ID: criticality-evidence-screening
Pattern Type: skill
Status: experimental
Owners: @JJediny

Testing

• Ran validator, index generation, index checks, and unsafe-shell scan.
• Examples/output are public-safe and contain no system evidence.

Safety Checklist

• No secrets, PII, CUI, internal URLs, hostnames, customer data, or proprietary information.
• Output contract defines prohibited content.

Security Skill Checklist

• This PR adds one security skill.
• Deny-by-default governance frontmatter is set.
• No scripts or prompt bodies were copied from public sources.
• Public-source intake record is below and recorded in frontmatter.
• needs-human-review label applied and human security review requested.

Public Source Intake

intake:
  skill_id: criticality-evidence-screening
  source:
    name: OMB M-19-03
    url: https://www.whitehouse.gov/wp-content/uploads/2018/12/M-19-03.pdf
    license: public-domain
    type: docs
  reviewed_by: "@JJediny"
  review_date: "2026-10-19"
  concepts_used: |
    Evidence-oriented consideration of mission impact, critical services, dependencies, and high-value information.
  content_NOT_imported: |
    No agency inventory, scoring form, scripts, prompts, or system-specific HVA material was copied.
  scripts_present_in_source: no
  network_assumptions: |
    The skill is read-only and denies network access. Citation is for human review.
  safety_concerns: |
    The skill makes no designation and excludes real sensitive evidence.
  license_concerns: |
    Public-domain federal source; no source text was copied.
  decision: adopt-as-inspiration
  decision_notes: |
    The memorandum informs screening concepts; this is an independently authored evidence-quality review.

Validation Results

48/48 files passed validation
All validators passed
unsafe-shell scan: 0 error(s), 0 warning(s)

Additional Context

This PR is a limited preliminary-evidence review, not an HVA procedure. It explicitly rejects automatic conclusions from High FISMA, PII/CUI, public exposure, interface count, or provider posture.