magpie-security-issue-fix

<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files): <project-config> → adopting project's `.apache-magpie/` directory <tracker> → value of `tracker_repo:` in <project-config>/project.md <upstream> → value of `upstream_repo:` in <project-config>/project.md Before running any bash command below, substitute these with the concrete values from the adopting project's <project-config>/project.md. --> # security-issue-fix This skill automates the "attempt a fix" step of the security handling process for issues in [`<tracker>`](https://github.com/<tracker>). It composes with the [`security-issue-sync`](../security-issue-sync/SKILL.md) skill — it always runs the sync first so that the issue's state is reconciled with the mail thread and any existing PRs before attempting any new work. **Golden rule:** Every state-changing action — writing files in the local `<upstream>` clone, committing, pushing to the user's fork, opening a public PR, editing or commenting on `<tracker>`, drafting mail on the `security@` thread — is a *proposal* that requires explicit confirmation from the user before it runs. The fact that the user invoked the skill is not a blanket "yes". In particular, **nothing public is pushed without the user explicitly approving the exact PR title, body and diff first.** **Confidentiality is paramount.** The resulting PR in `<upstream>` is public to the world. It must not reveal the CVE ID, the secu...