feat(standards): add GDPR review rule

plugins/engineering-playbook/skills/coding-standards/SKILL.md

@@ -36,6 +36,17 @@ All text and names must tell the truth about the implementation they represent.
 3. Prefer renaming over hiding behavior behind vague, aspirational, or
    overly-polished language.
 
+## Rule: GDPR
+During every feature implementation and code review, check whether personal data
+is involved. If so, do not complete or approve the change until these are clear:
+
+- Why the data is collected and the lawful basis.
+- How the minimum necessary data is processed and protected.
+- How long the data is retained.
+- When and how the data is deleted.
+
+Treat unknown GDPR requirements as blockers and request privacy or legal guidance.
+
 ## Rule: Hexagonal Architecture
 Follow hexagonal architecture as the baseline.
 

plugins/engineering-playbook/skills/pull-request/SKILL.md

@@ -12,6 +12,8 @@ description: >-
 
 1. Use a short Conventional Commit title. Do not add an issue number to the title
    unless the repository requires it.
+   In this repository, classify skill-file changes as `feat` or `fix`, never
+   `docs`.
 2. Write one high-level plain-English paragraph for the body. Leave out
    implementation details, test logs, file lists, checklists, and review notes
    unless a repository template requires them.