Add project Cursor skills and CI extras (actionlint, Dependabot)

Goal

Make the factory playbooks and ops runbooks discoverable to Cursor agents via project skills under .cursor/skills/, and round out Phase 5 CI with actionlint and Dependabot for Actions version bumps.

Acceptance criteria

• Skills factory-orchestrator, factory-worker, factory-reviewer, public-repo-hygiene, sandbox-operator, gitops-k8s-change exist under .cursor/skills/ and link playbooks/runbooks instead of duplicating them
• ci.yml gains an actionlint job; .github/dependabot.yml covers github-actions
• CI green including gitleaks; no cluster-deploy steps added to Actions (ADR-008)