Add dependency advisory graph skill

[fengyangxxx]

Summary

• Add the public dependency-advisory-graph runx skill.
• Emit exact-version advisory graph evidence with typed fields, false-positive guards, verification JSON, and report output.
• Add standalone runner fixtures for advisory hit, clean manifest, and invalid manifest stop/error coverage.

Registry

• Published fengyangxxx/dependency-advisory-graph@0.1.1 to https://api.runx.ai.
• Public listing: https://runx.ai/x/fengyangxxx/dependency-advisory-graph
• Clean install command: runx add fengyangxxx/dependency-advisory-graph@0.1.1 --registry https://api.runx.ai

Verification

• pnpm exec vitest packages/cli/src/skill-refs.test.ts tests/official-skill-catalog.test.ts --run
• npx -y @runxhq/cli@0.6.13 harness ./skills/dependency-advisory-graph/fixtures/*.yaml -R ./.runx-linux-receipts/dependency-advisory-graph-fixtures-final --json
• npx -y @runxhq/cli@0.6.13 add fengyangxxx/dependency-advisory-graph@0.1.1 --registry https://api.runx.ai --to ./.runx-install-test/dependency-advisory-graph-0.1.1 --json
• npx -y @runxhq/cli@0.6.13 harness ./.runx-install-test/dependency-advisory-graph-0.1.1/fengyangxxx/dependency-advisory-graph/0.1.1/SKILL.md -R ./.runx-linux-receipts/dependency-advisory-graph-hosted-harness-0.1.1 --json
• Registry dogfood receipt: runx:receipt:sha256:a1b3feddc1dadeb88cf239e8ce1f31035ecc6aa0fa2526e883faac5c92f54a61
• npx -y @runxhq/cli@0.6.13 verify --receipt ./.runx-linux-receipts/dependency-advisory-graph-registry-dogfood-0.1.1/dogfood-receipt-only.json --json