feat: k8s-cost-visibility skill, security hardening, and guardrails-by-default

[initializ-mk]

Summary

• k8s-cost-visibility skill: Estimates Kubernetes infrastructure costs (compute, storage, LoadBalancer) with cost attribution reports grouped by namespace, workload, node, label, or annotation. Supports auto/aws/gcp/azure/static/custom pricing modes. Read-only — only uses kubectl get.
• Filesystem traversal prevention for cli_execute: Blocks shell interpreters (bash, sh, zsh, etc.) unconditionally. Validates path arguments — rejects paths inside $HOME but outside workDir. Overrides HOME env to workDir in subprocesses. Sets cmd.Dir to workDir.
• Tool output guardrails: AfterToolExec hook scans tool output for secrets/PII before it enters the LLM context. Enforce mode blocks with a generic error (no guardrail type leaked). Warn mode redacts matches with [REDACTED].
• Guardrails on by default: --enforce-guardrails now defaults to true. Added --no-guardrails flag. DefaultPolicyScaffold() includes all 4 built-in guardrails even without forge build.
• Session max age: Configurable via memory.session_max_age or FORGE_SESSION_MAX_AGE. Stale sessions are discarded to prevent poisoned error context.

Security fixes

Addresses social-engineering attack where an agent was tricked via Slack into listing ~/Library/Keychains/, reading the login keychain, and base64-encoding it as a file attachment:

Attack vector	Mitigation
bash -c "ls ~/Library/Keychains"	Shell interpreters unconditionally denied
ls ~/Library/Keychains/	Path arg blocked (inside $HOME, outside workDir)
cat ../../.ssh/id_rsa	Relative path escape blocked
Subprocess ~ expansion	HOME overridden to workDir in env
Secret in tool output reaches LLM	CheckToolOutput redacts/blocks before LLM context
Error leaks "guardrail no_pii"	Generic "tool output blocked by content policy" message

Test plan

• TestCLIExecute_ShellInterpreterBlocked — all 8 shells rejected
• TestValidatePathArg_BlocksHomeTraversal — 13 cases (workDir allowed, system allowed, home traversal blocked)
• TestLooksLikePath — 14 cases covering paths, flags, plain args
• TestCLIExecute_PathTraversalBlocked — integration test with ls $HOME
• TestCLIExecute_HomeOverriddenToWorkDir — verifies subprocess HOME = workDir
• go test ./... passes in forge-core and forge-cli
• golangci-lint run clean in both modules