Add rds-upgrade-advisor skill

[leachwi]

Summary

Adds rds-upgrade-advisor, a read-only, multi-engine Amazon RDS / Aurora
major-version upgrade-readiness skill. For every database in an account it
reports:

1. Current engine version and support status (DEPRECATED / EXTENDED_SUPPORT /
   UPCOMING_EOL / SUPPORTED), classified against bundled per-engine support
   calendars.
2. A configuration view (region, AZ/Multi-AZ, cluster topology, replicas, global
   membership, class/storage, tags), counting each Aurora cluster as one database.
3. Analysis of any past failed/blocked upgrade evidence the engine produced
   (MySQL PrePatchCompatibility.log, Aurora MySQL JSON prechecks, PostgreSQL
   pg_upgrade logs, MariaDB upgrade/error log, SQL Server native log/ERROR*,
   Oracle dbtask/alert logs, Db2 db2diag.log), with each finding classified
   ERROR / WARNING / NOTICE and ordered remediation.
4. A recommended upgrade strategy (Blue/Green vs in-place vs snapshot-restore)
   with engine-specific caveats.

Engines: MySQL, Aurora MySQL, PostgreSQL, Aurora PostgreSQL, MariaDB, Oracle, SQL
Server, Db2. It runs interactively (single-database questions) and as a scheduled
account-wide audit (concise chat roll-up + full downloadable artifact). It is
strictly read-only and never initiates an upgrade.

Why a new skill (not an extension of rds-operation-review)

rds-operation-review is a broad Well-Architected operational review that touches
version currency as one scoring line. This skill is a dedicated upgrade workflow:
per-engine EOL calendars, past-upgrade precheck-log parsing with
ERROR/WARNING/NOTICE classification, and per-engine upgrade-method strategy — none
of which the ORR skill does. It mirrors the precedent of eks-upgrade-readiness
being its own skill rather than part of an EKS ops review.

Enrichment over the base agent (from functional evals)

The clearest differentiator is the account-wide structured audit: with the
skill, the agent produces a consistent per-engine, status-classified,
titled-artifact report (functional eval account-upgrade-readiness-audit:
with-skill 3/3 vs without-skill 0/3 on expected output; 2–3x the assertion pass
rate; more consistent across iterations). On the failed-upgrade and Extended
Support evals the head-to-head quality comparison favors with-skill. On narrow
single-database questions the base model is already capable (several assertions
flagged "always passes") — the skill's value is structure, consistency, and
precheck-log analysis at scale, not re-teaching facts the model knows.

Testing

• Structure: 12/12 (100%).
• Best-practices: 17/17, 0 warnings, 5/5 iterations, 100% consistency.
• Functional: 21/21 iterations successful; all triggers 3/3 (incl. the
  should-not-trigger negative eval); quality comparison favors with-skill where
  evaluated. Results committed under evals/.

Evals ran in a sandbox account against a purpose-built mixed-engine RDS/Aurora
fleet (including a seeded failed MySQL 8.0→8.4 upgrade). AWS account IDs, instance
IDs, and resource names in the committed eval journals are redacted.

Notes

• references/ holds the per-engine EOL calendars, upgrade-finding references, the
  engine-dispatch table, and a least-privilege read-only IAM policy
  (references/iam-policy.json). assets/audit-output-format.md holds the
  at-scale output format.
• Oracle and Db2 guidance is documentation-grounded (those engines were
  unavailable in the test account); the skill marks those paths and relies on
  events + a config-readiness review rather than fabricating a precheck report.
• Sample code; not intended for production use without additional review and
  testing (see the skill README's non-production disclaimer).

By submitting this pull request, I confirm that my contribution is made under the
terms of the Apache License 2.0.