fix-security-vulnerabilitieslisted

# Fix Security Vulnerabilities ## Overview Full-lifecycle skill for dependency and security vulnerability management. Aggregates findings from multiple sources, de-duplicates, discovers stale PRs, prioritizes by severity and complexity, and **prepares** fixes — then produces an **Update Plan** where merging is always a human action. This operationalizes the "Package updates and security vulnerabilities" policy in `CLAUDE.md`. It complements — it does not replace — the report-oriented `vuln-assessment` and `sbom` skills: those *assess and score*; this one *triages and fixes*. ## Context Before starting, read the repo's `CLAUDE.md` / `CLAUDE.local.md` and any relevant notes under `memory/` (e.g. `memory/repo/<repo>/`, `memory/feedback/`). These record which sources apply to this repo, the PR/CI conventions, and any ADO project tag. ## THE IRON LAWS These apply without exception: 1. **Query every source that applies to this repo.** Never act on a single Dependabot PR alone. If a source is unavailable, follow the Source Failure Handling protocol — never skip silently. 2. **Never create or modify a fix PR without rewriting its body to the repo's PR template.** 3. **Never merge automatically.** All merges are explicit user steps in the Update Plan. (This mirrors the universal PR rule in `CLAUDE.md`: only the human merges.) ## Package-Update Discipline (from `CLAUDE.md`) When a fix bumps a package version, apply the same rigor as any package update: | Bump | Action | |---