feat: add HOL Guard runtime safety skill

[kantorcodes]

Summary

Adds HOL Guard as a maintained runtime-safety skill for local agent workflows.

• Adds skills/hol-guard/ with a direct HOL Guard install and protected-run workflow.
• Uses hol-guard detect --json as the harness source of truth, then bootstrap, install, protected dry-run/run, doctor, status, approvals, and receipts.
• Pins HOL Guard 3.0.12, the verified stable release used by this contribution, and fails closed when protection cannot be verified.
• Adds repository and Copilot marketplace discovery metadata so the skill is installable through this project's maintained distribution surfaces.
• Keeps provider/client authorization and native safeguards authoritative; this does not claim hosted or server-side interception.

No interactive client-specific install attestation is claimed here. The 3.0.12 factual refresh updates the pinned release and removes evergreen current-stable wording; no new runtime or CI validation is claimed for that refresh.