Restrict auto-apply to trusted review comments so spoofed issue comments
cannot write optimized SKILL.md content into pull request branches.
Reject activation symlinks that escape the source root and add
regression coverage for both security checks.
Add a Unix activation script, Antigravity-specific installer guidance,
and cross-platform recovery documentation so users can reduce the
live skill set when truncation or context overload appears.
Regenerate the canonical bundle/catalog artifacts after merging the
stale goldrush-api removal so main stays release-ready.
Refs #381