chore: Security review plugins

[shashank-factory]

Summary

Replaces the manual security skills installation process with the new droid plugin CLI, switching from a git-clone-and-copy approach to the security-engineer@factory-plugins marketplace plugin.

Changes

• action.yml: Replaced the ~50-line "Install Security Skills" step (sparse git clone, per-skill copy, verification loop) with a 3-line "Install Security Plugin" step using droid plugin marketplace add and droid plugin install security-engineer@factory-plugins --scope user.
• security/action.yml: Applied the same simplification to the standalone security action, reducing ~25 lines of shell to the same plugin install commands.
• src/create-prompt/templates/security-report-prompt.ts: Updated the "Security Skills Available" section to reference the plugin source (security-engineer@factory-plugins) instead of the local ~/.factory/skills/ directory.
• src/create-prompt/templates/security-review-prompt.ts: Same prompt reference update as above.

Implementation Details

The previous approach cloned Factory-AI/skills with a sparse checkout, copied four individual skill directories (threat-model-generation, commit-security-scan, vulnerability-validation, security-review) into ~/.factory/skills/, and ran a multi-step verification. The new approach delegates all of this to the droid plugin CLI, which handles marketplace registration, download, and installation in two commands. Both action files include graceful fallback warnings if the plugin install fails.

Testing

[To be filled by author]

Related Issues

[To be filled by author]

[factory-droid]

Droid finished @shashank-factory's task —— View job

---

[factory-droid]

Droid finished @shashank-factory's task —— View job

---

Security Review Plugin PR — Validation Complete

Reviewed 2 candidate comments from Phase 1. Both were rejected as speculative best-practice suggestions rather than definite runtime bugs — the graceful-continue-on-failure pattern is intentional and matches the prior implementation. No inline comments posted. PR review summary submitted.

[factory-droid]

This PR cleanly replaces the manual git clone + sparse checkout skill installation with the droid plugin CLI. The failure-handling pattern (warn and continue) is consistent with the prior implementation. No actionable bugs found.