[SimplicityGuy]

Resolve the 14 currently open code-scanning alerts and update agnix to v0.59.0 with its verified commit pin.

• Alerts Add project-baseline skill for new-repo bootstrap and audit #1–feat: dependabot-setup skill; make repo-ci-setup generic #8: declare license: MIT in all eight skill manifests, matching the repository license.
• Alerts ci: add skill security scanners; dependabot-setup and repo-ci-setup updates #9–ci(deps): bump the actions-version-updates group with 3 updates #14: honor the existing reviewed SkillSpector baseline when exporting SARIF for GitHub. The scanner already emits these six results with external suppressions, but GitHub still opens alerts for them. Export only active findings, preserve the original local report, and prefix result paths with skills/ so future alerts point to actual repository files. No scanner rules or new findings are disabled.
• Dependabot found agnix v0.59.0 in run 39283181665, then filtered it because it was two days old and the implicit cooldown is three days. It selected v0.58.0 for merged PR ci(deps): bump the actions group with 2 updates #12. Preserve the three-day cooldown explicitly with cooldown.default-days: 3, and separate version/security update groups. Keep the weekly schedule. Checkout, setup-uv, and CodeQL upload pins are already current.

Validation: pinned Cisco scanner reports zero findings; pinned SkillSpector reports only the six existing baseline-suppressed results and the GitHub export contains zero results. Adapter tests cover preserving active/rejected/pending findings, suppression filtering, and repository-relative paths; removing the filtering or path repair makes the tests fail. actionlint and git diff --check pass. CI runs the adapter regression tests.

Existing alerts on main will close after this change is merged and the main-branch security scan uploads its results.

Evidence: Dependabot run, GitHub cooldown reference.