feat(installer): Add selective install filters and new skill

Add installer filters for risk, category, and tags so maintainers and
users can ship smaller skill surfaces to context-sensitive runtimes.
Document the reduced-install flow for OpenCode-style hosts, add the
humanize-chinese community skill, and sync the generated catalog and
plugin-safe artifacts that now reflect the release batch.

Refs #437
Refs #440
Refs #443

tools/scripts/tests/skill_utils_security.test.js

@@ -3,7 +3,7 @@ const fs = require("fs");
 const os = require("os");
 const path = require("path");
 
-const { listSkillIds, listSkillIdsRecursive } = require("../../lib/skill-utils");
+const { listSkillIds, listSkillIdsRecursive, readSkill } = require("../../lib/skill-utils");
 
 function withTempDir(fn) {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), "skill-utils-security-"));
@@ -110,3 +110,33 @@ withTempDir((root) => {
     fs.lstatSync = originalLstatSync;
   }
 });
+
+withTempDir((root) => {
+  const skillsDir = path.join(root, "skills");
+  const skillDir = path.join(skillsDir, "metadata-skill");
+  fs.mkdirSync(skillDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(skillDir, "SKILL.md"),
+    `---
+name: metadata-skill
+category: backend
+risk: safe
+metadata:
+  tags: "[api, saas]"
+---
+
+# metadata-skill
+`,
+    "utf8",
+  );
+
+  const skill = readSkill(skillsDir, "metadata-skill");
+
+  assert.strictEqual(skill.category, "backend", "readSkill should expose category metadata");
+  assert.strictEqual(skill.risk, "safe", "readSkill should expose risk metadata");
+  assert.deepStrictEqual(
+    skill.tags,
+    ["api", "saas"],
+    "readSkill should normalize inline tag lists from metadata.tags",
+  );
+});