chore: SOTA audit fixes – catalog recursive, readme regex, docs, CI, installer

- P0: Catalog includes nested skills (listSkillIdsRecursive), 626 skills
- P0: update_readme.py regex fixes 'high-performance agentic skills'
- P1: SKILL_ANATOMY risk values aligned to none|safe|critical|offensive (EN + vi)
- P1: requirements.txt + CONTRIBUTING Python setup
- P1: data/package.json version 4.6.0
- P2: npm run test + CI test step; validator docs + validation-baseline in .gitignore
- P3: Installer --version/--tag support; CI npm audit; __pycache__ in .gitignore

lib/skill-utils.js

@@ -159,8 +159,29 @@ function listSkillIds(skillsDir) {
     .sort();
 }
 
+/**
+ * Recursively list all skill directory paths under skillsDir (relative paths).
+ * Matches generate_index.py behavior so catalog includes nested skills (e.g. game-development/2d-games).
+ */
+function listSkillIdsRecursive(skillsDir, baseDir = skillsDir, acc = []) {
+  const entries = fs.readdirSync(baseDir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.name.startsWith('.')) continue;
+    if (!entry.isDirectory()) continue;
+    const dirPath = path.join(baseDir, entry.name);
+    const skillPath = path.join(dirPath, 'SKILL.md');
+    const relPath = path.relative(skillsDir, dirPath);
+    if (fs.existsSync(skillPath)) {
+      acc.push(relPath);
+    }
+    listSkillIdsRecursive(skillsDir, dirPath, acc);
+  }
+  return acc.sort();
+}
+
 module.exports = {
   listSkillIds,
+  listSkillIdsRecursive,
   parseFrontmatter,
   parseInlineList,
   readSkill,