security-advisory skill: bring the fix to v2/main through a public PR, converting the card to an opaque issue first #5334

The security-advisory skill says an advisory's fix "reaches v2/main through a PR in this repository" (step 5, closing the fork's PR), but gives no recipe for opening that PR. Its step 6, and AGENTS.md (Issue-driven work style, the [GHSA- draft-card rule), still say the draft card converts to an issue only after publication, so the public PR has no issue to Closes, and no card tracks it.

The flow used for GHSA-w766-5x43-whvw (#5332, #5333), which the skill and the rule should describe:

1. When the fix is ready to merge (close to the release, since the patch is public from the merge on), convert the draft card to an issue, keeping the opaque title ([GHSA-…]) and the link-and-triage body. Label it v2, its type and server scope, and give it the release's milestone. The card keeps its place and fields.
2. Push the fork's branch to this repository under the same opaque name (v2/fix/<ghsa-id>) and open a PR against v2/main with Closes #N, an opaque title and a body that describes no part of the vulnerability. Link it with addCloseIssueReferences; card → In Review.
3. No Copilot loop on that PR: its comments would describe the vulnerability in public. The review happened in the fork.
4. Merge it once CI passes; close the issue, card → Done.
5. Close the fork's PR (the existing recipe).
6. After publication, retitle the issue [GHSA-…] - <published summary> and replace its body's triage lines with the advisory link (what step 6 does today to the card).

Update the skill (steps 4–6 and the flow table), the AGENTS.md rules that say conversion waits for publication and that the fork's PR is the fix's PR, and board-ops if its advisory section restates the timing.