chore: SOTA audit fixes – catalog recursive, readme regex, docs, CI, installer

- P0: Catalog includes nested skills (listSkillIdsRecursive), 626 skills
- P0: update_readme.py regex fixes 'high-performance agentic skills'
- P1: SKILL_ANATOMY risk values aligned to none|safe|critical|offensive (EN + vi)
- P1: requirements.txt + CONTRIBUTING Python setup
- P1: data/package.json version 4.6.0
- P2: npm run test + CI test step; validator docs + validation-baseline in .gitignore
- P3: Installer --version/--tag support; CI npm audit; __pycache__ in .gitignore

data/bundles.json

@@ -1,5 +1,5 @@
 {
-  "generatedAt": "2026-02-02T18:58:37.318Z",
+  "generatedAt": "2026-02-02T21:03:06.925Z",
   "bundles": {
     "core-dev": {
       "description": "Core development skills across languages, frameworks, and backend/frontend fundamentals.",
@@ -55,6 +55,7 @@
         "frontend-mobile-security-xss-scan",
         "frontend-security-coder",
         "frontend-slides",
+        "game-development/mobile-games",
         "go-concurrency-patterns",
         "golang-pro",
         "graphql",
@@ -319,7 +320,6 @@
         "unity-ecs-patterns",
         "using-neon",
         "vector-database-engineer",
-        "xlsx",
         "xlsx-official"
       ]
     },
@@ -357,6 +357,7 @@
         "error-diagnostics-error-trace",
         "expo-deployment",
         "flutter-expert",
+        "game-development/game-art",
         "git-pr-workflows-git-workflow",
         "gitlab-ci-patterns",
         "gitops-workflow",