AI assisted rules gen implementation tracking issue

Implementation for konveyor/enhancements#275

## Implementation Tracking

- [x] **Go helpers (cmd/)** —helper commands invoked by skills via `go run ./cmd/`.

- [x] **Agent skills — 4 SKILL.md files with references**
Four agent skills following AgentSkills.io format: generate-rules (orchestrator), rule-writer, test-generator, rule-validator.

- [x] **Eval harness**

- [x] **golden sets for eval coverage**

- [x] **Cross-model evals**
Run eval suite across different models (Claude Sonnet, Claude Opus, Gemini 2.5 Flash, Gemini 2.5 Pro, GPT-4o) to identify model-specific regressions and establish minimum quality baselines.

- [x] **CI/CD — GitHub Actions workflows**
GitHub Actions for: (1) unit tests on PR (`go test ./internal/...`), (2) lint/vet, (3) eval runs on skill changes (regression gate).

- [ ] **End-to-end pipeline validation across languages**
Validate full pipeline works for all supported languages: Java (java.referenced, java.dependency), Go (go.referenced, go.dependency), Node.js (nodejs.referenced), C# (csharp.referenced), and builtin types (filecontent, xml, json, file). Run generate-rules against real migration guides for each language family.

- [ ] **Security hardening — SSRF mitigation, path traversal, input validation**
URL ingestion with SSRF mitigation blocking loopback/private IPs, path traversal prevention in workspace directory names, structured extraction formats constraining LLM output. Verify implemented and tested.

- [ ] **User-facing documentation and README**
User-facing documentation: README with quickstart, architecture overview, skill usage examples, CLI reference.