docs(skills): extend ecosystem-neutral commands catalog-wide (#404 Phase 2)

Follow-up to #419, addressing the remaining normative npm-family
commands federicobartoli's grep on #404 identified:

- incremental-implementation: the four increment-checklist exit criteria
  and the example prompt now use the repository's own test/build/
  typecheck/lint commands, pointing at the TDD skill's Discover the
  Stack First section
- planning-and-task-breakdown: task-template verification lines use the
  template's placeholder style instead of hardcoded npm commands
- shipping-and-launch: the security checkbox names the ecosystem's
  dependency audit rather than npm audit alone
- debugging-and-error-recovery: the diagnosis/bisect/verify command
  blocks are labeled as npm examples with substitution notes
- references/security-checklist.md: OWASP row 6 generalizes npm audit
  to the native dependency audit
- security-and-hardening needed no change: its SKILL.md was already
  neutralized (detected-package-manager wording)

Ride-along: pins the below-zero debit behavior (ValueError) in TDD eval
case 3, per nucliweb's non-blocking review note on #419.

references/security-checklist.md

@@ -181,7 +181,7 @@ res.status(500).json({
 | 3 | Injection | Parameterized queries, input validation |
 | 4 | Insecure Design | Threat modeling, spec-driven development |
 | 5 | Security Misconfiguration | Security headers, minimal permissions, audit deps |
-| 6 | Vulnerable Components | `npm audit`, keep deps updated, minimal deps |
+| 6 | Vulnerable Components | Native dependency audit (`npm audit`, `pip-audit`, ...), keep deps updated, minimal deps |
 | 7 | Auth Failures | Strong passwords, rate limiting, session management |
 | 8 | Data Integrity Failures | Verify updates/dependencies, signed artifacts |
 | 9 | Logging Failures | Log security events, don't log secrets |