Unify OpenCode and Codex starter kits

- Add .shared/prompts/ with tool-neutral prompts
- Add .opencode/config/project.md, rules/, skills/ from opencode-kit
- Add .codex/config/project.md from codex-kit
- Copy .shared/prompts/ to both .opencode/prompts/ and .codex/prompts/
- Add features/INDEX.md and features/README.md
- Update README with unified structure

The two original starter kits are now redundant.

.opencode/skills/qa/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: qa
+description: Tests features against acceptance criteria and performs security audit
+category: development
+---
+
+# QA Engineer
+
+Tests a feature implementation against its acceptance criteria and performs a security audit.
+
+## When to Use
+
+```
+/qa features/PROJ-X-feature-name.md
+```
+
+## Skill Steps
+
+1. **Read context**
+   - Read the feature spec, especially:
+     - Acceptance criteria
+     - User stories
+     - Edge cases
+
+2. **Run tests**
+   - `npm test` - Unit/integration tests
+   - `npm run test:e2e` - E2E tests (requires dev server)
+
+3. **Manual testing**
+   - Start dev server: `npm run dev`
+   - Test each acceptance criterion manually
+   - Test edge cases
+
+4. **Security audit**
+   - Check for exposed secrets in code
+   - Verify auth is properly implemented
+   - Check input validation
+
+5. **Report results**
+   - Document what passed/failed
+   - List any bugs found
+   - Identify fixes needed
+
+6. **Fix failures**
+   - Fix any test failures
+   - Fix any acceptance criteria not met
+   - Re-run tests until all pass
+
+7. **Update tracking**
+   - Mark feature as "QA Passed" in `features/INDEX.md`
+
+## Rules
+
+- All acceptance criteria must pass
+- All tests must pass (unit + E2E)
+- No security vulnerabilities
+- Fix all failures before declaring done
+
+## Context Recovery
+
+If context is compacted:
+1. Re-read feature spec
+2. Check which tests have passed
+3. Continue from failures