perf(repo-health): trim the family's skills without changing behaviour

[liwenjie200543]

Apply the #1342 setup-family recipe to the repo-health family (#1349),
as previously applied to setup (#1353), pr-management (#1390), and issue
(#1400).

What changed

Always-on frontmatter — the five skills over the 200-token budget
(dependency-license-audit ~256, audit-finding-fix ~211,
license-compliance-audit ~214, flaky-test-triage ~210,
ci-runner-audit ~207, workflow-security-audit ~204) had their
description / when_to_use tightened; every quoted routing phrase is
kept.

Bodies — the two skills over the 5,000-token / 500-line budgets moved
sub-action-specific sections byte-for-byte into sibling files, leaving
one-line pointers:

skill	siblings	measured tokens	lines
dependency-license-audit	audit-tool-setup.md, scan-commands.md, license-normalization.md	5244 → 3455	523 → 315
audit-finding-fix	compose-commit.md, draft-pr-procedure.md, pre-pr-adversarial-review.md	6170 → 4584	591 → 450

The moved sections are byte-identical to the text on main (verified by
script, not by eye). Family total: 27979 → 24475 measured tokens (−12.5%).
All seven skills now sit inside the 5,000-token body budget, the 500-line
cap, and the 200-token always-on budget.

measured_tokens was re-stamped via skill-token-count; surface_hash
was re-stamped only where structural anchors moved between files
(dependency-license-audit) — the other five keep their hashes.

How checked

• tools/dev/estimate-skill-tokens.py --check: OK (published figures
  match the live frontmatter).
• check-placeholders.sh, check-duplication.py,
  check-companion-skills.py: OK.
• The skill-evals suites for audit-finding-fix and
  dependency-license-audit need the --cli model runner, so they are
  left to CI rather than this offline environment.
• Note: check-skill-config.py flags pre-existing requires_config table
  drift in docs/{security,setup,utilities}/README.md — present on
  main before this PR and untouched by it.

Gen-AI disclosure

Authored with ZCode (GLM) under
docs/ai-contribution-policy.md;
every line reviewed and the checks above run locally by me before posting.

[Kaap10]

LGTM on the optimization pass! All quoted routing triggers are strictly preserved, frontmatters/bodies sit well within budgets, and static checks pass.

Minor nit:
In dependency-license-audit/ (audit-tool-setup.md, license-normalization.md, and scan-commands.md), the # <Title> top-level heading is immediately repeated as a ## <Title> sub-heading below the companion preamble. You can drop the duplicate ## <Title> for cleaner markdown structure.

Also, please rebase on latest main to resolve the merge conflict so this can be merged.

[liwenjie200543]

Both done: the duplicated ## <Title> sub-headings in the three dependency-license-audit companions are dropped, and the branch is rebased on current main. The rebase folds in #1470's Snapshot-drift removal for audit-finding-fix (the section is gone from SKILL.md; the Drift check prerequisite now points at the generated pre-flight block), with surface_hash / measured_tokens re-stamped via the repo tools. All static checks pass locally.

[onlyarnav]

lgtm