[tool] Update skills_lint to ^0.5.2 and add SARIF code scanning

[reidbaker-agent]

I dont know if you want the comments in prs that edit skills. If you dont just close this pr and update on your own schedule.

Details

## Summary

• Bump skills_lint dev_dependency in tool/pubspec.yaml to ^0.5.2.
• Add .github/workflows/code_scanning.yaml to run skills_lint --format=sarif and upload SARIF diagnostic reports to GitHub Code Scanning.

Workflow Details

• Triggers: On pull requests and pushes to main touching .agents/**, skills/**, tool/**, or .github/workflows/code_scanning.yaml.
• Permissions: contents: read at workflow level; contents: read and security-events: write for the sarif_scan job.
• SARIF Generation: Runs dart run skills_lint --format=sarif from tool/, leveraging 0.5.2's config-relative path resolution (tool/skills_lint.yaml -> ../skills).
• Upload: Uploads via github/codeql-action/upload-sarif with category skills_lint, guarded against fork PRs where security-events: write is unavailable.
• Gate: Enforces exit code check on linter status so PR checks fail if violations exist.

Verification

• Tested config-relative path resolution empirically from tool/ with dart run skills_lint.
• Verified local SARIF generation and validated SARIF 2.1.0 JSON format.
• Ran dart format . (clean).
• Ran dart analyze --fatal-infos tool/ (0 issues).
• Ran unit and validation tests via dart test (all passed).