Improve SubImage coverage

What this does

Three passes:

1. Detect which providers the user's current repo and local environment touch (Terraform providers, CLI configs, git remotes).
2. Cross-reference with subimageListModules to compute coverage gaps and link them to the right setup skill.
3. Inspect the security rules that have findings: list them directly, group by tag, and surface the top actionable ones, prioritizing tags whose resources come from a recently-detected or newly-enabled provider.

This is the bridge between IaC reality and SubImage observability. Most other skills assume the wiring is already done; this one finds the wiring that is missing and the findings that prove it would have been worth doing.

When to use

✅ User opens this skill in their IaC or scripts repo and wants a coverage audit. ✅ User just enabled a new module and wants to know which findings now light up. ✅ User wants this on a recurring cadence (weekly recurring prompt on the IaC repo). ✅ Onboarding of a new tenant: catches what was forgotten.