Add a CloudBurn agent skill for guided cost checks

What

Create a portable Agent Skill that lets people use CloudBurn through a coding agent instead of piecing together CLI commands and rule IDs themselves.

The agent should turn a user's goal into a safe CloudBurn workflow: find the relevant rules, propose a .cloudburn.yml, run the requested IaC or live discovery checks, and explain the findings in plain language.

Why

CloudBurn already exposes the building blocks through rules list, config, scan, and discover, but users still need to know which mode, services, and rule IDs fit their goal. An agent can bridge that gap without adding another interface to the CLI.

Scope

• Add a standards-compatible cloudburn skill with a concise SKILL.md and only the references or scripts it needs.
• Support prompts such as:
  • "Check this Terraform project for EBS and EC2 cost issues."
  • "Show me which live discovery checks fit this AWS account."
  • "Create a config that runs S3 and EBS discovery checks as JSON."
  • "Run only the checks that don't need account-wide Resource Explorer setup."
• Ask for the user's scan target, IaC versus discovery mode, AWS services, region, output format, and config preference when those choices matter.
• Use cloudburn rules list to confirm current rule IDs and mode support instead of hard-coding a stale catalog.
• Generate or update .cloudburn.yml with the supported iac and discovery fields: enabled-rules, disabled-rules, services, and format.
• Show the proposed config before writing it and preserve unrelated settings in an existing config.
• Treat cloudburn discover init as a separate setup step because it changes AWS Resource Explorer. Explain the change and get explicit approval before running it.
• Check prerequisites and surface useful recovery steps when Node.js, CloudBurn, AWS credentials, Resource Explorer, or the requested rule support is missing.
• Prefer structured CLI output where available so the agent doesn't scrape tables.
• Add realistic skill evals for config generation, static scans, live discovery planning, and refusal to guess unknown rules.
• Document installation and a few copy-paste prompts for users.

Acceptance criteria

• The skill follows the open Agent Skills specification and passes its validator.
• The same skill works in at least Codex and Claude Code without vendor-specific instructions in the core workflow.
• Tests or scripted evals prove that it selects valid rules, writes valid config, and doesn't run discover init without approval.
• The skill never hides a CloudBurn command failure or invents a rule ID.

Start by locating the existing skill structure and the CloudBurn entry points named in the issue: rules list, config, scan, and discover. Read the Agent Skills specification and determine how SKILL.md, references or scripts, and the validator fit together. Done means the skill passes validation, has evals for the listed workflows, preserves config, uses valid rules, and requires approval before discover init.