feat(skills): add investigation guides for ten CloudWatch families - #16

Adds a read-only Last9 MCP investigation skill for ten AWS CloudWatch families: Billing, RDS/Aurora, ElastiCache, MSK, DynamoDB, EC2, SQS, DMS, KMS, and S3. The shared workflow verifies metric sources, resource dimensions, statistic semantics, units, coverage, freshness, and cited observations. Agents load the relevant family reference as needed; guidance links to public AWS documentation. Implements ENG-1891.

Packaging includes tracked Markdown references alongside each skill entrypoint, rejects unsupported or untracked payloads and symlink escapes, and isolates temporary archives. Family guidance covers estimated charges, period totals and averages, overlapping resource populations, approximate gauges, sparse storage observations, and the difference between a latest period statistic and a window peak.

Validation at candidate 46ac7db00f2d44995d3abfc634f3a17beb32ed61: all four public CI checks passed. The paired synthetic pilot passed 12/12 structured candidate cases across all ten families, with zero fixture misses or excluded pairs; the metrics regression passed 5/5 structured cases. All 125 offline checks, targeted TypeScript checks, workflow lint, distribution checks, reference links, and whitespace checks passed. The candidate entrypoint and ten references were verified by individual content hashes.

These results establish the bounded structured pilot. Manual review still found prose assumptions about period boundaries, source timestamps, ingestion, and transport statistic mappings that exceed the supplied evidence; unrestricted answer accuracy is not established. Baseline completion failures also prevent treating this single paired run as a statistical uplift claim. Earlier explicit Claude/Codex/Cursor loading checks cover earlier revisions; automatic activation, installation, and live telemetry behavior remain unverified.