feat: add dev-app skill for TickShield app development contract

Guides and constrains eco-app development in independent repos against the
TickShield platform contract: listingKey identity, app.manifest.json fields,
tickshield-node-runtime base image, guard four-gate authz, tenant_id isolation,
portal-sdk host bridge for micro frontends, release-cli publish and store
deployment. Ships copy-ready templates (manifest/Dockerfile/server.js/web
skeleton/Gitea release workflow/PRD) plus a zero-dependency static checker
(scripts/check-app.sh) covering die/warn contract items.

README.md

@@ -46,6 +46,7 @@ npx skills remove runtime-image -g
 | [skill-forge](skills/skill-forge/SKILL.md) | 交互式创建新 Skill 的流水线,一问一答采集触发词/流程/红线,产出可直接使用的 SKILL.md |
 | [push-and-report](skills/push-and-report/SKILL.md) | 标准收尾流程:盘点 git 变更 → 英文 conventional commit → 推送远程 → SPMS 日报 |
 | [gitea-actions](skills/gitea-actions/SKILL.md) | 按统一规范给项目生成/评审优化 Gitea Actions 构建部署工作流(buildx 推 Gitea Packages → 本机重建容器 → 清理旧版本) |
+| [dev-app](skills/dev-app/SKILL.md) | 按 TickShield 平台契约在独立仓库开发/审查/发布生态应用(listingKey 四位一体、四道闸、tenant_id 租户隔离、release-cli 上架部署),含模板组与静态检查脚本 |
 
 ## 目录结构