/claim #2226

Summary

• Adds tokenization scope evidence gates to pci-dss-review.
• Requires PAN path proof, hosted-field isolation, telemetry/session-replay redaction, token scope/reuse properties, webhook/log storage checks, and SAQ eligibility rationale.
• Adds token risk classification and common leakage paths for hosted payment designs.
• Updates the output template, common pitfalls, and changelog for pci-dss-review v1.0.1.

Why

Issue #2226 notes that tokenization and hosted fields can reduce PCI scope only when evidence proves PAN never hits merchant systems, logs, analytics, support tooling, or error telemetry. This PR makes the evidence gates explicit while also identifying token properties that can keep systems in scope.

Validation

• git diff --check
• Frontmatter required-field check across skills and roles
• index.yaml file existence check
• Prompt-injection phrase scan across skills and roles
• Targeted rg check for version and new tokenization sections