Add tutorial for using and extending the skills library

[unclet67]

What

Adds docs/TUTORIAL.md — an end-to-end tutorial for the skills library.

Why

The repo has thorough framework-coverage docs in the README, but no single
onboarding walkthrough that takes a new user from install → understanding how
agents consume skills → reading a skill → authoring and validating a new one.
This fills that gap.

Contents

The tutorial covers:

• What the repository is and how it's structured
• Installation (npx skills add, git clone, Claude Code plugin)
• How agents use skills via progressive disclosure (~30 tokens to scan,
  500–2,000 to load), with a worked example
• Skill anatomy — frontmatter, body sections, supporting files
• A hands-on walkthrough running analyzing-network-traffic-of-malware
• Framework mappings and the ATT&CK Navigator layer
• Authoring a new skill + naming/quality rules
• Validating with tools/validate-skill.py
• A quick-reference cheat table

Notes for reviewers

• Single new file; no existing content changed.
• Written against the current ATT&CK v19.1 framing used at the top of the README.
  Heads-up: a collapsed section lower in the README still references the older
  pre-v19 (14-tactic Defense Evasion) layout and "754/754 skills mapped" — worth
  a consistency pass, but out of scope for this PR.

🤖 Generated with Claude Code