feat(skills): Phase 14 — Trail of Bits skill index + router

Replace the hardcoded skill-name stub with a real, routable skill index.

- skills.py (zero-dep): SkillDescriptor inventory (~22 ToB skills with routing
  metadata — languages, tags, vulnerability classes, stages — plus a short operating
  checklist each), aligned with the spec's routing examples. route_skills scores by
  vulnerability-class/tag/stage signal with a language filter+bonus, and never selects
  on a pure language match. route_skills_for_target derives vuln classes from tags;
  select_skill_context packs checklists into a char budget; skill_chunks chunks the
  guidance into the `skills` retrieval namespace.
- hunter.select_skill_snippets now delegates to the router (existing C-memory and
  crypto+auth routing expectations preserved).
- hunter_harness._describe feeds the budget-capped routed skill context into the
  HarnessX hunter prompt (the genuine consumer of skill_budget_chars).
- 8.4 zero-dep guard extended to cover skills.py.

tests/test_skills.py (9 tests: C parser → memory/fuzzing, crypto → constant-time/
vector, language-mismatch + language-only exclusion, stage filtering, budget cap,
namespace chunking). openrouter-sast-harness Phase 14 checked off.

188 passed, 4 skipped; ruff + mypy clean; detection gate PASS.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

src/openultrasast/hunter.py

@@ -135,19 +135,10 @@ def build_retrieval_context_by_path(root: Path, targets: list[FileTarget], *, ma
 
 
 def select_skill_snippets(target: FileTarget, *, max_snippets: int = 4) -> list[str]:
-    tags = set(target.tags)
-    snippets: list[str] = []
-    if target.language in {"c", "cpp", "c++"} or "memory_unsafe" in tags:
-        snippets.extend(["address-sanitizer", "libfuzzer", "harness-writing"])
-    if "parser" in tags or "fuzzable" in tags:
-        snippets.extend(["fuzzing-dictionary", "fuzzing-obstacles"])
-    if "crypto" in tags:
-        snippets.extend(["constant-time-analysis", "wycheproof"])
-    if "auth_boundary" in tags or "network_entry" in tags:
-        snippets.extend(["sharp-edges", "insecure-defaults"])
-    if "deserialization" in tags:
-        snippets.append("semgrep-rule-creator")
-    return sorted(dict.fromkeys(snippets))[:max_snippets]
+    """Route the target to its most relevant Trail of Bits skills (ids), via the skill index."""
+    from .skills import route_skill_ids
+
+    return route_skill_ids(target, max_snippets=max_snippets)
 
 
 def _run_hunter_task(