audit-resilience — The "80% Problem" Non-Functional Audit

Agents nail the happy path (CRUD, passing tests) and silently skip what decides whether code survives real traffic: a webhook with no idempotency key double-charges; a fetch with no timeout hangs the request; a retry storm with no backoff takes down the dependency; PII lands in plaintext logs. This audit finds those gaps before production does.

Read-only. This skill inventories resilience gaps and hands each to the right fix skill. It does not change code.

Phase 0 — Detect the surfaces