ci: add release gates and advisory Skylos scan

[duriantaco]

Summary

• Clarifies Vouch’s value proposition in the README... risky AI-written changes should not ship just because CI passed.
• Adds a password-reset example to explain contracts, obligations, evidence, and release decisions.
• Adds GitHub Actions CI with required-style Go checks and VouchBench acceptance.
• Adds Skylos as an advisory, non-blocking scan for severe quality/security/dead-code signals.

CI Gates

Required checks to enable in branch protection:

• Go checks
• VouchBench acceptance
• Skylos advisory (advisory)

Skylos is intentionally non-blocking via continue-on-error and --force, so findings show up in Actions annotations/summary without blocking merges.

Tests

  - `go test ./...`
  - `scripts/vouchbench.sh --out /tmp/vouchbench-ci` passed 114/114 assertions