feat: add acm-certificate-ops-review skill

[tez-tm]

Summary

Adds a new skill for ACM and ACM Private CA certificate health investigation and operational review.

What this skill does

• Phase 1 (Operational review): Inventories ACM certificates across accounts and regions, detects health issues (expiry, failed/stuck renewals, PENDING_VALIDATION, imported certs that cannot auto-renew, weak key algorithms, unused certs, missing DaysToExpiry monitoring, stale endpoints, ACM Private CA problems), classifies findings by risk (RED/AMBER/GREEN), and produces a prioritized findings report with remediation recommendations.
• Phase 2 (CA/Browser Forum readiness, on request): Assesses automation readiness for the upcoming validity reductions (398 to 47 days by March 2029), provides a DV vs OV/EV migration decision tree, and identifies gaps.

Agent types

All agents (Chat tasks, Incident RCA, Incident Triage)

Testing

• Agent Skill Eval: PASSED (Grade A, Audit 100/100, Trigger 1.0, Functional 0.76)
• DevOps Agent Space: Skill auto-invoked without being named. Produced correct prioritized findings report matching expected risk classifications across 5 test scenarios (expiring cert, weak key, failed validation, imported in-use, multi-region).

IAM permissions required

Read-only: acm:ListCertificates, acm:DescribeCertificate, acm-pca:ListCertificateAuthorities, acm-pca:DescribeCertificateAuthority, cloudwatch:DescribeAlarmsForMetric, organizations:ListAccounts (org-wide only).

Checklist

• Skill follows Agent Skills specification and CLAUDE.md conventions
• SKILL.md with valid frontmatter (name, description, metadata)
• README.md with 8-section structure
• CHANGELOG.md at v1.0.0
• .skilleval.yaml + evals/ directory with functional and trigger tests
• Tested with DevOps Agent (skill auto-invokes, steps make sense)
• Agent Skill Eval passed (report.json "passed": true)
• llms.txt updated
• No scripts or executable content