fix(skills): add database-migration and dependency-audit vocabulary to two skill descriptions

Two skills carry core body content whose vocabulary never reached their
descriptions, so Tier-2 trigger routing cannot see it:

- deprecation-and-migration: Expand/Contract database schema migrations
  (added in #345) - description now mentions database schema migration,
  renaming/dropping a column, expand/contract.
- security-and-hardening: dependency-audit triage and supply-chain hygiene
  (hardened in #392, delegated to by code-review-and-quality) - description
  now mentions dependency audits, audit-finding triage, supply-chain risk.

Adds four positive trigger cases so the suite can see these gaps.
Measured: baseline 86% (72/84); cases-only 82% (4 hard misses, 'shares no
vocabulary'); cases+fix 86% (76/88), 140 checks, 0 errors, no existing case
loses rank 1.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

evals/cases/deprecation-and-migration.json

@@ -13,6 +13,14 @@
       {
         "prompt": "How do I remove this old feature safely for existing users?",
         "top_k": 3
+      },
+      {
+        "prompt": "Rename a database column without downtime",
+        "top_k": 3
+      },
+      {
+        "prompt": "How do I drop a column safely in production?",
+        "top_k": 3
       }
     ],
     "negative": [

evals/cases/security-and-hardening.json

@@ -13,6 +13,14 @@
       {
         "prompt": "Harden the webhook endpoint that fetches user-supplied URLs",
         "top_k": 3
+      },
+      {
+        "prompt": "Run a dependency audit and triage the findings",
+        "top_k": 3
+      },
+      {
+        "prompt": "Is this new package safe to install? Check for typosquatting and supply chain risk",
+        "top_k": 3
       }
     ],
     "negative": [

skills/deprecation-and-migration/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: deprecation-and-migration
-description: Manages deprecation and migration. Use when removing old systems, APIs, or features. Use when migrating users from one implementation to another. Use when deciding whether to maintain or sunset existing code.
+description: Manages deprecation and migration. Use when removing old systems, APIs, or features. Use when migrating users from one implementation to another. Use when migrating a database schema in production, such as renaming or dropping a column without downtime (expand/contract). Use when deciding whether to maintain or sunset existing code.
 ---
 
 # Deprecation and Migration

skills/security-and-hardening/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: security-and-hardening
-description: Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when personal data or privacy compliance (GDPR, CCPA) is involved.
+description: Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.
 ---
 
 # Security and Hardening