chore: pin Symfony and Microsoft Graph skills for this repo

Research in docs/research flagged missing tooling for the project's
actual stack: Symfony backend work and Microsoft Graph calendar sync
had no matching local skill. Searched skills.sh and installed
project-level:

- dev-toolings/superpowers-symfony (11 of 44 skills, matching what
  stack.md/config-secrets.md already decided on: config/secrets vault,
  bootstrap check, PHPUnit TDD + functional tests + mocking, controller
  cleanup, quality checks, DI/autowiring, Cache component, Doctrine
  migrations). Skipped the API Platform, Messenger/CQRS, hexagonal-
  architecture, Twig-component, and Pest skills — none of those are
  part of the decided stack (plain MVC JSON API, no API Platform, TS
  frontend not Twig, PHPUnit not Pest).
- merill/msgraph (offline-indexed Graph API search, no network calls)
  for the Outlook/Exchange calendar sync decided in stack.md.

No CalDAV/Nextcloud skill was installed: every candidate on skills.sh
is either a personal-calendar CLI wrapper (vdirsyncer+khal) or gated
behind a third-party SaaS account (Membrane) — neither fits writing a
PHP backend integration against sabre/dav, which the research doc
already speccs out directly.

skills-lock.json is tracked; .claude/skills/ payloads are gitignored
(msgraph alone is 112MB of multi-platform binaries + SQLite indexes)
and restored per-clone via `npx skills experimental_install -y`.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tu1c13iVNdj1iWL633yazG

.gitignore

@@ -52,3 +52,8 @@
 # Embedded web-server pid file
 /.web-server-pid
 
+# Claude Code skill payloads (restorable via `npx skills experimental_install`
+# from skills-lock.json, which IS tracked) and agent worktree scratch space
+/.claude/skills/
+/.claude/worktrees/
+