feat(skills): add privacy-by-design skill for PbD principle assessment

[pratik wayase (PratikWayase)]

Description

Adds the privacy-by-design skill to provide standalone privacy assessment knowledge bases that complement the existing privacy-standards skill. This skill enables the Privacy Reviewer and Privacy Planner agents to perform structured assessments against the 7 Foundational Principles of Privacy by Design (PbD), verify retention/disposal compliance, and map findings to enforceable obligations across GDPR, Australian Privacy Principles (APP), and CCPA/CPRA.

This is a documentation-only knowledge skill (Programming Language: Other) and does not include executable scripts, as it feeds structured reasoning into the existing assess -> verify -> report pipeline without requiring agent modification.

Related Issue(s)

Closes #2594

Type of Change

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update

AI Artifacts:

• Reviewed contribution with hve-builder and addressed all actionable findings
• Copilot skill (.github/skills/*/SKILL.md)

Note: This is a Programming Language: Other knowledge-base skill per Issue #2594. It contains only markdown reference documents consumed by the Privacy Reviewer/Planner agents. No executable runtime exists; therefore no scripts or tests are applicable.

Validation & Testing

Since this is a markdown-only knowledge skill, it was tested using the repository's standard validation pipelines to ensure structure, frontmatter, and link integrity. All checks passed with 0 errors:

• npm run validate:skills = 57 skills validated, 0 errors, 0 warnings
• npm run lint:md = 529 files linted, 0 errors
• Frontmatter validation = 832 files checked, 0 errors

Sample Prompts (for AI Artifact Contributions)

User Request:
Review this codebase for Privacy by Design compliance against GDPR and Australian Privacy Principles.

Execution Flow:

1. Codebase Profiler detects signals (consent flows, retention configs, deletion endpoints) via references/codebase-signals.md
2. Privacy Reviewer loads this skill alongside privacy-standards
3. Agent consults references/00-index.md to route to appropriate reference files
4. Assesses each of 7 PbD Principles using criteria in references/pbd-seven-principles.md
5. Verifies lifecycle protection using checklist in references/retention-and-disposal.md
6. Maps every finding to verbatim legal citations using references/cross-jurisdictional-mapping.md
7. Emits structured JSON findings per schema in references/finding-formats.md

Output Artifacts:

{
  "id": "PBD-02-001",
  "principle": "Principle 2: Privacy as the Default Setting",
  "status": "FAIL",
  "severity": "HIGH",
  "evidence": "src/components/CookieBanner.tsx:42 defaults to opt-out",
  "citation": "gdpr_article_25_2",
  "recommendation": "Change default to opt-in; require explicit consent toggle"
}