feat(skills): Phase 14 — Trail of Bits skill index + router

Replace the hardcoded skill-name stub with a real, routable skill index.

- skills.py (zero-dep): SkillDescriptor inventory (~22 ToB skills with routing
  metadata — languages, tags, vulnerability classes, stages — plus a short operating
  checklist each), aligned with the spec's routing examples. route_skills scores by
  vulnerability-class/tag/stage signal with a language filter+bonus, and never selects
  on a pure language match. route_skills_for_target derives vuln classes from tags;
  select_skill_context packs checklists into a char budget; skill_chunks chunks the
  guidance into the `skills` retrieval namespace.
- hunter.select_skill_snippets now delegates to the router (existing C-memory and
  crypto+auth routing expectations preserved).
- hunter_harness._describe feeds the budget-capped routed skill context into the
  HarnessX hunter prompt (the genuine consumer of skill_budget_chars).
- 8.4 zero-dep guard extended to cover skills.py.

tests/test_skills.py (9 tests: C parser → memory/fuzzing, crypto → constant-time/
vector, language-mismatch + language-only exclusion, stage filtering, budget cap,
namespace chunking). openrouter-sast-harness Phase 14 checked off.

188 passed, 4 skipped; ruff + mypy clean; detection gate PASS.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

src/openultrasast/hunter_harness.py

@@ -126,12 +126,16 @@ class HxScanOrchestrator:
         return HunterPoolResult(findings=sorted(findings, key=lambda item: item.finding_id), trajectories=trajectories)
 
     def _describe(self, task: HunterTask) -> str:
+        from .skills import select_skill_context
+
         context = task.retrieval_context or f"[repo_code] {task.target.path}"
+        skills = select_skill_context(task.target, stage="hunt", budget_chars=task.budget.skill_budget_chars)
+        skill_block = f"\n\nRelevant security skills:\n{skills}" if skills else ""
         return (
             f"Audit `{task.target.path}` ({task.target.language}) for security-relevant vulnerabilities. "
             f"Report ONLY evidence-backed findings as a JSON array, each object: "
             f'{{"line": <int>, "title": <str>, "cwe": "CWE-NN" (optional), "rationale": <str>}}. '
-            f"Emit `[]` if none.\n\nSource context:\n{context}"
+            f"Emit `[]` if none.{skill_block}\n\nSource context:\n{context}"
         )
 
     def _findings_from_result(self, task: HunterTask, result: object, policy: dict[str, CwePolicy]) -> list[StaticFinding]: