Add upstream compatibility analysis skill

[vitormattos]

Summary

Add a focused upstream-compatibility skill as the first implementation increment for LibreSign/libresign#8991.

The workflow:

• starts from the target repository's actual platform/runtime/dependency bounds;
• requires an authoritative upstream source;
• rejects upstream changes that do not intersect verified local usage;
• reports the affected version boundary, likely surface, existing CI/test coverage and one focused verification step;
• distinguishes confirmed relevance from plausible impact and irrelevant/noise;
• remains report-only until a maintainer separately authorizes follow-up work;
• includes historical positive/negative evaluation cases and a structural test protecting both the local-usage requirement and publication boundary.

Design

This complements diagnose-ci-failure: proactive compatibility analysis identifies likely upstream risks before a failure; if a real CI failure exists and attribution is unclear, causal diagnosis remains in the CI skill.

No recurring monitoring is enabled by this PR. The pilot must first demonstrate signal/noise against real and historical Nextcloud/ecosystem changes.

Validation

• DCO-signed and cryptographically signed commit;
• Validate agent skills / package passed, including metadata/reference checks, package tests and REUSE licensing.

Relates to LibreSign/libresign#8991.