feat(opencode): add OpenUltraSAST steering skills

.opencode/skills/openultrasast-scan/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: openultrasast-scan
+description: OpenUltraSAST scan, index, quick, standard, deep, SARIF, and report workflows. Use when running or planning `ousast scan`, repository indexing, or evidence-gated SAST analysis from opencode.
+---
+
+# OpenUltraSAST Scan
+
+Use this skill to steer OpenUltraSAST scan workflows from opencode.
+
+## Workflow
+
+1. Confirm the target is a local repository path.
+2. Run commands through uv, never by activating a virtualenv manually.
+3. Start with quick mode unless the task explicitly requires standard or deep analysis.
+4. Treat quick findings as `static_corroboration`, not verified vulnerabilities.
+5. Preserve run artifacts under `.openultrasast/runs/<scan-id>/`.
+6. Report `scan_id`, `run_dir`, finding count, and the strongest available evidence level.
+
+## Commands
+
+```bash
+uv run ousast scan <repo> --mode quick
+uv run ousast index <repo>
+uv run pytest
+```
+
+## Evidence Rules
+
+- `suspicion` means a model or weak signal raised a hypothesis.
+- `static_corroboration` means deterministic code evidence exists.
+- `crash_reproduced` requires an artifact-backed reproducer.
+- `root_cause_explained` requires independent verifier reasoning.
+- `patch_validated` requires rerunning relevant checks after the patch.
+
+Do not describe a finding as verified unless its evidence level meets the configured report threshold.