feat: add DevSecOps security engineering stack

[Quazmoz]

Summary

Add a dedicated cybersecurity-focused DevOps specialist stack for defensive review, hardening, incident analysis, implementation, and release qualification across Terraform/OpenTofu, Ansible/Automation Platform, Jenkins, CI/CD, GitOps, IAM, containers/Kubernetes, and software supply chain.

What changed

• add canonical DevSecOps Security Engineer
• add reusable DevSecOps security skill
• add structured implementation prompt, JSON Schema, and example task
• add 42-scenario adversarial/security acceptance suite
• add quickstart and thin GitHub Copilot custom-agent adapter
• add dedicated stack contract validator and wire it into the canonical validation suite
• route the specialist consistently for Codex, Claude Code, Copilot, and the engineering/index layers
• register the stack in agentdefaults.manifest.json and bump manifest version to 0.14.0

Security focus

Terraform / OpenTofu

• protect state and saved plans as sensitive assets
• distinguish sensitive redaction from actual state omission
• review remote backend access/encryption/locking/recovery
• enforce provider/module provenance, constraints, .terraform.lock.hcl, and immutable/reviewed refs
• prefer short-lived workload identity where supported
• gate destructive and privilege-changing plans

Ansible / Automation Platform

• prevent plaintext secrets and runtime/output leakage
• explicitly treat Vault as at-rest protection; use safe runtime handling such as no_log where required
• scope become narrowly and prefer purpose-built idempotent modules
• flag disabled certificate/host-key verification unless explicitly justified
• review inventory authority, collection/role provenance, execution-environment trust, AAP RBAC/credentials/templates/webhooks, and output/artifact leakage

Jenkins

• require authenticated least-privilege authorization
• isolate the controller from untrusted builds
• separate trusted and untrusted agents and credential/network reachability
• prevent untrusted PR/fork Pipeline code from receiving privileged credentials
• review shared-library/Groovy trust, JCasC/seed configuration, plugins/advisories, CSRF, TLS/reverse proxy, parameter/env injection, workspace/cache/artifact integrity, and deployment identity

Authority and verification

The specialist defaults to observation/proposal and does not infer permission for credential, IAM, Terraform-state, network, Jenkins-controller, AAP-RBAC, or production mutation from tool availability.

Material findings use P0-P3 severity with evidence, threat/failure scenario, blast radius, remediation, verification, and residual risk. Executed checks must be reported separately from unavailable/unrun checks.

Validation

Expected canonical gate:

python3 scripts/validate-agentdefaults.py

The new scripts/validate-devsecops-security-stack.py is part of that suite and verifies stack registration, schema authority contracts, platform invariants, routing, acceptance-test coverage, and validator integration.