feat: add NIST CSF 2.0 nist_csf field to all 754 cybersecurity skills

Mapped every skill to NIST CSF 2.0 subcategory IDs (GV/ID/PR/DE/RS/RC functions)
based on subdomain and content analysis. Restores 11 skills corrupted during
prior rebase, re-enriching with ATLAS, D3FEND, NIST AI RMF, and CSF 2.0 fields.

All 754 skills now carry structured mappings for all 5 security frameworks:
- MITRE ATT&CK (in tags)
- MITRE ATLAS v5.5 (atlas_techniques)
- MITRE D3FEND v1.3 (d3fend_techniques)
- NIST AI RMF 1.0 (nist_ai_rmf)
- NIST CSF 2.0 (nist_csf)

skills/performing-linux-log-forensics-investigation/SKILL.md

@@ -1,12 +1,29 @@
 ---
 name: performing-linux-log-forensics-investigation
-description: Perform forensic investigation of Linux system logs including syslog, auth.log, systemd journal, kern.log, and application logs to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised Linux systems.
+description: Perform forensic investigation of Linux system logs including syslog, auth.log, systemd journal, kern.log, and
+  application logs to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised
+  Linux systems.
 domain: cybersecurity
 subdomain: digital-forensics
-tags: [linux-forensics, syslog, auth-log, systemd-journal, journalctl, linux-logs, ssh-forensics, cron, audit-log, log-analysis]
-version: "1.0"
+tags:
+- linux-forensics
+- syslog
+- auth-log
+- systemd-journal
+- journalctl
+- linux-logs
+- ssh-forensics
+- cron
+- audit-log
+- log-analysis
+version: '1.0'
 author: mahipal
 license: Apache-2.0
+nist_csf:
+- RS.AN-01
+- RS.AN-03
+- DE.AE-02
+- RS.MA-01
 ---
 
 # Performing Linux Log Forensics Investigation