fix(ci): PYTHONPATH for tests + Mermaid diagrams and security guardrails on all skills

[msaad00]

Summary

CI fix

• PYTHONPATH=src + --override-ini="testpaths=tests" for skill-level pytest
• Fixes ModuleNotFoundError: No module named 'src' that was failing test-iam-departures

SKILL.md enhancements (all 5 skills)

Mermaid diagrams replacing ASCII art (renders natively on GitHub):

• AWS CIS: IAM/S3/CloudTrail/VPC -> checks.py -> JSON/Console/SARIF
• GCP CIS: IAM/Storage/Logging/Network/Vertex AI -> checks.py
• Azure CIS: Entra ID/Storage/Monitor/NSG/AI Foundry -> checks.py
• IAM departures: HR -> Reconciler -> S3 -> EventBridge -> Step Function -> Audit
• Vuln remediation: Scan -> S3 -> Triage (P0-P3 SLAs) -> Patcher -> Audit

Security Guardrails section added to every skill:

• CSPM skills: read-only, no data exfiltration, idempotent, safe for production
• IAM departures: deny policies on protected accounts, grace period, rehire safety, VPC isolation, encryption, dual audit
• Vuln remediation: PR-first for P1/P2, 24h rollback window, protected packages allowlist, VEX support, reversible quarantine

Test plan

• ruff check and ruff format pass locally
• CI should now pass: lint + test-iam-departures + cfn-lint + terraform validate + security scan