Merge current main into development guidance

Reconcile the read-only guidance output with the machine-readable skill index,
adopt linked sample references required by bounded retrieval, and update the
guidance regression fixture for the retrieval helper dependency. Permit only
the known endpoint-DLP metadata stream during read-only evidence capture.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 638b66d2-9f06-4f60-8781-808709e1485c

schemas/skill-index.schema.json

@@ -0,0 +1,86 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://github.com/microsoft/BCQuality/schemas/skill-index.schema.json",
+  "title": "BCQuality action-skill index",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "generatedAt", "skillCount", "sourceSnapshot", "skills"],
+  "properties": {
+    "version": { "const": 1 },
+    "generatedAt": { "type": "string", "format": "date-time" },
+    "skillCount": { "type": "integer", "minimum": 0 },
+    "sourceSnapshot": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "skills": {
+      "type": "array",
+      "items": { "$ref": "#/definitions/skill" }
+    }
+  },
+  "definitions": {
+    "stringArray": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 }
+    },
+    "skill": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path",
+        "layer",
+        "id",
+        "version",
+        "title",
+        "description",
+        "inputs",
+        "outputs",
+        "filters",
+        "subSkills",
+        "sourceSha256"
+      ],
+      "properties": {
+        "path": { "type": "string", "pattern": "^(microsoft|community|custom)/skills/.+\\.md$" },
+        "layer": { "enum": ["microsoft", "community", "custom"] },
+        "id": { "type": "string", "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$" },
+        "version": { "type": "integer", "minimum": 1 },
+        "title": { "type": "string", "minLength": 1 },
+        "description": { "type": "string", "minLength": 1 },
+        "inputs": { "$ref": "#/definitions/stringArray" },
+        "outputs": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 1,
+          "items": {
+            "enum": ["findings-report", "development-guidance-report"]
+          }
+        },
+        "filters": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["bc-version", "technologies", "countries", "application-area"],
+          "properties": {
+            "bc-version": {
+              "type": "array",
+              "items": {
+                "oneOf": [
+                  { "type": "integer", "minimum": 1 },
+                  { "type": "string", "pattern": "^(all|[1-9][0-9]*\\.\\.[1-9][0-9]*|[1-9][0-9]*\\.\\.)$" }
+                ]
+              }
+            },
+            "technologies": { "$ref": "#/definitions/stringArray" },
+            "countries": { "$ref": "#/definitions/stringArray" },
+            "application-area": { "$ref": "#/definitions/stringArray" }
+          }
+        },
+        "subSkills": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^(microsoft|community|custom)/skills/.+\\.md$"
+          }
+        },
+        "sourceSha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+      }
+    }
+  }
+}