[skill] Add hol-guard - fail-closed AI runtime safety

[kantorcodes]

What this adds

Adds hol-guard as a DevSecOps skill for protecting supported local AI coding harnesses before mutation-bearing tool work.

The skill directly installs and invokes HOL Guard, obtains the exact harness identifier from hol-guard detect --json, and requires the Guard-owned bootstrap → install → protected dry-run → doctor → protected run → status path before protection is claimed. It fails closed on deny/review/unhealthy/error states and keeps native harness authorization, sandboxing, confirmations, and provider controls authoritative. Guard Cloud remains opt-in.

Security use cases

• Pre-tool runtime protection for supported local coding agents
• Explicit approval/denial handling for Guard-blocked actions
• Guard-owned status, doctor, receipts, inventory, ABOM, and event evidence
• Reproducible pinned HOL Guard 3.0.12 install without silently changing the active Python environment

Distribution

Registers the skill in the README and both repository-maintained Claude marketplace manifests, so acceptance makes HOL Guard directly discoverable/installable through SecOpsAgentKit's DevSecOps skill distribution.

Validation

The repository's exact scripts/validate_skill.py skills/devsecops/hol-guard previously passed 15/15 checks on this contribution, and both marketplace registrations plus the README discovery entry were verified. The 3.0.12 refresh changes the pinned HOL Guard release and removes evergreen current-stable wording; no new validator run is claimed for this refresh. The contribution adds no executable scripts, so no script-execution attestation is claimed.

Dependencies

• hol-guard CLI; the skill prefers isolated pipx installation when installation is requested.

No hosted/server-side interception is claimed; this is the local Guard runtime path only.