feat(skills): add build-and-pr and framework-modernizer skills

[mgouia]

Why

The team needed two new Copilot skills to close gaps in the developer workflow:

1. build-and-pr -- there was no automated path from a feature brief or review findings to a ready-to-merge PR. Developers had to manually branch, implement, validate, and open PRs while keeping the team's security/architecture/docs standards in mind.
2. framework-modernizer -- Express 4 deprecation warnings surfaced in the codebase with no structured migration playbook or automated audit path.

What changed

build-and-pr skill (.github/skills/build-and-pr/)

Given a work item (feature brief or list of review findings), the skill:

• Creates a new branch named from the work item scope
• Reads the team's guideline files (architect.agent.md, security.agent.md, and the auto-injected instruction files) before writing any code
• Implements the change staying strictly within the work item's scope -- anything larger goes into the PR description for a human reviewer instead of being coded
• Runs npm run lint and npm test, fixing failures before continuing (up to 3 cycles; escalates to the user on the third failure)
• Opens or updates the PR using a structured template

The skill was designed following the genesis architecture discipline: A2 PIPELINE + A9 SUPERVISED EXECUTION (weak form) with S7 deterministic tool bridges for all git/gh/npm interactions.

framework-modernizer skill (.agents/skills/ + .apm/skills/)

Audits an Express 4 codebase for breaking changes, classifies findings as SAFE/AUTOFIX/MANUAL, applies safe autofixes, and emits a phased migration plan. Includes:

• Full evals suite (evals/evals.json, trigger evals, fixtures)
• Breaking-changes reference (references/express-4-to-5-breaking-changes.md)
• Classifier rubric and phased plan template for human follow-through

Other

• my-skill placeholder stub added as an APM install harness target
• Both skills mirrored into .apm/skills/ for APM module resolution
• apm.lock.yaml updated to register the new skills

Notes for reviewers

• The build-and-pr skill uses weak-form A9 supervision (the agent holds write capability). Strong-form would require a gh-aw SafeOutputs surface, which isn't wired here. This is intentional and noted in the genesis handoff packet.
• The zava-storefront/package-lock.json file added in an earlier commit is a generated artifact from the nested directory and can be ignored.
• The .agents/ tree and .apm/ tree are mirrors; if the install path changes, only one needs updating.