chore: preserve risk/source and document use-section headings

docs/QUALITY_BAR.md

@@ -21,6 +21,7 @@ The skill MUST have a section explicitly stating when to trigger it.
 
 - **Good**: "Use when the user asks to debug a React component."
 - **Bad**: "This skill helps you with code."
+Accepted headings: `## When to Use`, `## Use this skill when`, `## When to Use This Skill`.
 
 ### 3. Safety & Risk Classification
 

scripts/normalize-frontmatter.js

@@ -8,6 +8,8 @@ const SKILLS_DIR = path.join(ROOT, 'skills');
 const ALLOWED_FIELDS = new Set([
   'name',
   'description',
+  'risk',
+  'source',
   'license',
   'compatibility',
   'metadata',