[Skill] ETW / .etl trace analysis

Parent: #126

Summary

A guidance skill that teaches an agent how to capture and analyze ETW traces (.etl) for performance, hangs, and diagnostics on Windows. Focused on the headless workflow — an agent has no WPA GUI, so it must drive capture and extraction from the command line and reason over text/structured output.

What the skill should teach the agent

• How to capture headlessly: WPR profiles (wpr -start / -stop), xperf, or netsh trace — and which to pick per scenario.
• How to turn a .etl into agent-readable data without WPA: e.g. tracerpt (CSV/XML), wpaexporter, xperf -a, PerfView headless, or the TraceProcessing library — then what to look for in CPU sampling, disk/file/network I/O, wait analysis, and hangs.
• Provider discovery (logman query providers) and custom EventSource events.
• Scenario playbooks: slow startup, UI hangs, high CPU, leaks — what to capture and how to interpret the extracted data.

Deliverables

• Skill (SKILL.md + supporting guidance files) under plugins/.
• Example walkthrough (headless capture → extract → interpret a slow-startup trace).

Open questions

• A live-ETW MCP server is a separate future item.

Start with the requested skill under plugins/ and review the ETW tools named in the issue: WPR, xperf, netsh trace, tracerpt, wpaexporter, PerfView, and TraceProcessing. Build the SKILL.md and supporting guidance around headless capture, extraction, provider discovery, and the listed diagnostic scenarios. Done means the skill includes a slow-startup walkthrough from capture through interpretation.