chore: expand Tech roster with hacking and cyber security skills

docs/game-design/skills.md

@@ -31,7 +31,7 @@ Domains are **content-shaped**, not a locked taxonomy. Early vision includes:
 | **Extraction** | Salvage, mining, harvesting, reclaiming scrap |
 | **Processing** | Refining, chemistry prep, material conversion |
 | **Fabrication** | Weaponsmith, armtech, synth-chem, cooking if we track it |
-| **Tech / intrusion** | Non-combat hacking, bypass, diagnostics—**combat-facing** net actions stay **gig** |
+| **Tech / intrusion** | Hacking, netsec, counter-intrusion, bypass, diagnostics—**combat-facing** net actions stay **gig** |
 | **Support craft** | Medtech fabrication, field repair kits, augment maintenance (**open** naming) |
 | **Social / street** | Negotiation, street doc *craft*, fences—**only if** we give them real loops and XP (**open**) |
 
@@ -50,7 +50,7 @@ New skills land here as **design + data** demand; a skill can sit in **multiple
 | **Gather** | Nodes, yields, field extraction |
 | **Process** | Refine (incl. fab-tech intermediates), batch, intermediate goods |
 | **Make** | Finished goods, recipes, bench work |
-| **Tech** | Intrusion, electronics, rigging that isn’t a gig kit |
+| **Tech** | Intrusion, netsec, counter-intrusion, electronics, signal—**not** combat gig kit |
 | **Social** | If we skill it: negotiation, contracts UI hooks (**open**) |
 
 Optional **secondary category** for UI sorting only—**primary** category in data drives balance defaults.
@@ -85,11 +85,17 @@ Optional **secondary category** for UI sorting only—**primary** category in da
 - **Rigging (gear)** — drones, harnesses, tool mods—**non-combat** rigging; combat deployables stay **gig**-gated (**open**).
 - **Food synth** — ration fab, street kitchens (**open** if we skill it).
 
-#### Tech — systems work that is not “today’s gig kit”
+#### Tech — systems, hacking, and cyber security (non-gig)
 
-- **Intrusion** — bypass doors, hijack non-combat systems, mission timers on networks (**combat** debuff/net attacks stay **gig**).
+**Skill** tech covers **prep**, **world interaction**, and **instance / downtime** work. **Combat** net attacks, debuffs, and “today’s gig kit” **ICE-breaking in a fight** stay **gig**-gated unless we deliberately duplicate (**open**).
-- **Electronics** — repair boards, swap modules, bench diagnostics on devices and vehicles.
+
-- **Signal** — scan, trace, tap—**out of combat** or **instance objectives**; battlefield version **open** (gig vs skill).
+- **Intrusion** — bypass locks and access control, pivot through non-combat systems, progress **hack timers** and objectives (e.g. [brainstorm/hack-bodyguard](brainstorm/hack-bodyguard-missions.md)).
+- **Netsec / hardening** — patch holes, segment networks, raise **defense** ratings for sites, convoys, or ally systems before/during downtime phases.
+- **Counter-intrusion** — trace hostile processes, sever sessions, quarantine malware—**defensive** counterpart to **Intrusion** in supported content.
+- **Exploit dev** — build or tune **payloads** and tools used by Intrusion (authorized pen-tests, heists, corps)—**open** vs folding into **Intrusion** mastery.
+- **Crypto & identity** — break weak schemes, spoof or forge **credentials** where content allows; ties rep and legality (**open**).
+- **Electronics** — repair boards, swap modules, bench diagnostics on devices and vehicles (physical layer adjacent to netsec).
+- **Signal** — scan, trace, tap—RF and traffic analysis **out of combat** or in **objectives**; jamming in **combat** **open** (gig vs skill).
 
 #### Social — only if we give real loops and XP