chore: SOTA audit fixes – catalog recursive, readme regex, docs, CI, installer

- P0: Catalog includes nested skills (listSkillIdsRecursive), 626 skills
- P0: update_readme.py regex fixes 'high-performance agentic skills'
- P1: SKILL_ANATOMY risk values aligned to none|safe|critical|offensive (EN + vi)
- P1: requirements.txt + CONTRIBUTING Python setup
- P1: data/package.json version 4.6.0
- P2: npm run test + CI test step; validator docs + validation-baseline in .gitignore
- P3: Installer --version/--tag support; CI npm audit; __pycache__ in .gitignore

scripts/build-catalog.js

@@ -1,7 +1,7 @@
 const fs = require('fs');
 const path = require('path');
 const {
-  listSkillIds,
+  listSkillIdsRecursive,
   readSkill,
   tokenize,
   unique,
@@ -297,8 +297,8 @@ function renderCatalogMarkdown(catalog) {
 }
 
 function buildCatalog() {
-  const skillIds = listSkillIds(SKILLS_DIR);
-  const skills = skillIds.map(skillId => readSkill(SKILLS_DIR, skillId));
+  const skillRelPaths = listSkillIdsRecursive(SKILLS_DIR);
+  const skills = skillRelPaths.map(relPath => readSkill(SKILLS_DIR, relPath));
   const catalogSkills = [];
 
   for (const skill of skills) {

scripts/update_readme.py

@@ -36,7 +36,7 @@ def update_readme():
 
     # 3. Update Intro Text Count
     content = re.sub(
-        r"(library of \*\*)\d+( high-performance skills\*\*)",
+        r"(library of \*\*)\d+( high-performance agentic skills\*\*)",
         rf"\g<1>{total_skills}\g<2>",
         content,
     )