feat: add HOL Guard security skill

[kantorcodes]

• A human has tested these changes.

---

Why

Add HOL Guard to the public OpenHands extensions registry as an operational security skill. The skill directly installs and invokes the real hol-guard and plugin-scanner CLIs for supported harness protection, approval/evidence review, and agent package scanning.

The scope is intentionally accurate: it does not claim that OpenHands itself has a native HOL Guard pre-tool interception hook or that openhands is a supported Guard harness target.

Summary

• add skills/hol-guard with the required SKILL.md, human README, plugin manifest, and vendor symlinks
• register hol-guard in the OpenHands marketplace under code-quality and update the generated README catalog
• keep runtime protection limited to harnesses currently documented by HOL Guard while supporting scanner workflows for OpenHands skills, plugins, MCP packages, and mixed agent workspaces

Issue Number

N/A - the current extensions contribution guide accepts fork-first skill submissions directly.

How to Test

1. Confirm the branch is one commit ahead of main with only the seven intended paths.
2. Confirm skills/hol-guard/.claude-plugin and .codex-plugin are symlinks to .plugin, and .plugin/plugin.json is valid JSON.
3. Run python scripts/sync_extensions.py --check.
4. Run the relevant skill/catalog tests, including pytest -q tests/test_skills_have_readme.py tests/test_sync_extensions.py.
5. Inspect skills/hol-guard/SKILL.md and verify it never maps openhands to a supported Guard harness or claims native OpenHands runtime interception.

I reproduced the changed-path catalog, coverage, manifest, required README, and symlink invariants from the current repository source before opening this PR. I could not execute the full repository test suite in the connected environment because it does not expose a filesystem clone of the complete repository, so this PR is intentionally opened as a draft for repository CI and human validation.

Video/Screenshots

Not applicable - documentation and registry metadata only.

Notes

The human-test checkbox is intentionally left unchecked. HOL Guard upstream sources are https://hol.org/guard and https://github.com/hashgraph-online/hol-guard-plugin.