Audit and harden the skills repository

[kinhluan]

Summary

• Make skills/ the single, real canonical source directory and remove the legacy .agent-skills tree, SKILL.toon copies, nested duplicates, and installer lock state.
• Audit all 64 skills for safety, current guidance, user authority, and research rigor; move oversized guidance into directly linked references for progressive disclosure.
• Synchronize release metadata at version 1.3.0, generate deterministic .skill archives, and add portable manifest/package validation.
• Replace the brittle router and hook configuration with portable routing for all 64 skills, plus CI and repository-integrity tests.

Why

The repository had competing source surfaces, stale generated artifacts, inconsistent release metadata, duplicate instructions, brittle routing, and several outdated or overly prescriptive claims. These made maintenance error-prone and could expose consumers to unsafe or misleading guidance.

Impact

Maintainers now have one repeatable make check release gate covering source validation, manifest consistency, routing behavior, current DORA semantics, safety regressions, and byte-for-byte package verification. Consumers receive 64 consistent deterministic packages.

This intentionally changes the canonical source path from .agent-skills/ (previously reached through a skills symlink) to a real skills/ directory. Any external tooling that directly references .agent-skills/ must switch to skills/.

Validation

• make check
• 64 skills validated across all release surfaces
• 15 unit/integrity tests passed
• 64 deterministic packages verified