docs(skills): add kfeatures-release-flow skill

[leodido]

A skill that captures the release-cut workflow used in the v0.5.0 cycle, so the next cut does not re-derive it from AGENTS.md and commit history.

Layout

.skills/kfeatures-release-flow/
├── SKILL.md
└── references/
    └── release-cut.md

SKILL.md triggers on phrases like "cut a kfeatures release", "tag vX.Y.Z", "regenerate release notes", "verify a kfeatures download", "GH007".

Content

• Staged CHANGELOG, commit, push, tag, push workflow with explicit-approval checkpoints at every git mutation, per AGENTS.md.
• GH007 / noreply identity recovery, with placeholders (<noreply-email>, <username>) and a pointer to .devcontainer/devcontainer.json for the canonical values.
• PR-label-driven categorized release notes: the .github/workflows/labeler.yml and .github/release.yml coupling, and the recipe for retro-labeling old PRs (gh pr edit --add-label / --remove-label, then GitHub UI > Edit > "Generate release notes" without re-tagging).
• Cosign keyless verification: the cosign verify-blob --bundle command and the certificate-identity-pins-the-tag detail.

Scope

Release engineering only. Per-PR CLI engineering rules (structcli error contracts, inMCPMode, printJSON, bats coverage matrix) stay in AGENTS.md and CONTRIBUTING.md. If they prove worth extracting later, that goes in a separate skill.

Validation

• Valid frontmatter (name + description).
• Name kebab-case, matches folder.
• Description has what, when, and trigger phrases.
• No forbidden files (README/CHANGELOG/etc.).
• Reference file linked from SKILL.md with description of when to read it.
• SKILL.md under 500 lines.
• No nested reference subdirs.