chore(skills): bump-transitive skill

[r0b1n]

No description provided.

[github-actions]

AI Code Review

✅ Approved — no issues found

---

What was reviewed

File	Change
.agents/skills/README.md	Added bump-transitive to directory listing and slash command table
.agents/skills/bump-transitive/SKILL.md	New skill — full process for surgically bumping a vulnerable transitive dep via pnpm.overrides

Skipped (out of scope): dist/, pnpm-lock.yaml

---

Positives

• Skill frontmatter (name, description) is present and accurate — description precisely matches what the skill does.
• The two-install pattern (add overrides → install → remove overrides → install) is correctly documented; the rationale for each step is explained so an agent can reason about edge cases rather than blindly follow steps.
• "What to flag" equivalent is captured concisely in the Rules section with clear negative examples (pnpm update, pnpm upgrade, --frozen-lockfile).
• The verification step (git diff … | grep) gives the agent a concrete pass/fail signal rather than asking it to eyeball the lockfile diff.
• The guard for direct dependencies (last rule) prevents the skill from being misused when an override is unnecessary.
• README directory listing and slash command table kept in sync — no stale references to the old fix-vuln-transitive name.