Merge origin/main (v2.1.0) into the code-review skill branch

Both sides added real content and this merge keeps both rather than picking one.

The branch predates the v2.1.0 release, so merging it straight would have REVERTED that
release: every plugin.json back from 2.1.0 to 2.0.0, and tests/test_consistency.py and
tests/test_validator.py deleted. Merged instead of pushed.

Conflicts, all resolved by combining:
- pm-ai-shipping/.claude-plugin/plugin.json - v2.1.0's version, the branch's description.
- security-audit-static - both checks survive as two steps: verify citations (2.1.0), then
  report with the OWASP Top 10 coverage backstop (branch).
- ship-check - the new correctness review becomes Step 3, and 2.1.0's parallel security +
  performance pair renumbers to Steps 4 + 5 behind it, keeping the branch's model-mix
  carry-through on the security bullet.
- Notes - 2.1.0's untrusted-input rule and both of the branch's bullets.

The v2.1.0 test suite then caught what the branch had missed: a third skill in pm-ai-shipping
without the counts to match. Root README headline 68 -> 69 skills, its pm-ai-shipping summary
2 -> 3, and marketplace.json's total and description synced to plugin.json. 15/15 tests and the
validator pass.

No version bump. The CHANGELOG entry sits under `## Unreleased`, which the tag-on-merge workflow
ignores by design, so this lands the skill without cutting a release - that call is Pawel's.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G42vsxSKL7je39AsHZ5aJm

.claude-plugin/marketplace.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://anthropic.com/claude-code/marketplace.schema.json",
   "name": "pm-skills",
-  "version": "2.0.0",
-  "description": "Structured AI workflows for better product decisions. 68 domain-specific skills and 42 chained workflows across 9 PM plugins — from discovery to strategy, execution, launch, growth, and shipping AI-built software.",
+  "version": "2.1.0",
+  "description": "Structured AI workflows for better product decisions. 69 domain-specific skills and 42 chained workflows across 9 PM plugins — from discovery to strategy, execution, launch, growth, and shipping AI-built software.",
   "owner": {
     "name": "Paweł Huryn",
     "email": "pawel@productcompass.pm",
@@ -59,7 +59,7 @@
     },
     {
       "name": "pm-ai-shipping",
-      "description": "AI Shipping Kit — for PMs and founders accountable for AI-built code. Document a vibe-coded app, audit it for intended-vs-implemented security gaps and performance issues, and produce a reviewer-ready shipping packet.",
+      "description": "AI Shipping Kit — for PMs and founders accountable for AI-built code. Document a vibe-coded app, review it for correctness, security and performance defects, and produce a reviewer-ready shipping packet.",
       "source": "./pm-ai-shipping",
       "category": "product-management"
     }