kai-upgrade

SUSPICIOUS: the stated purpose matches a self-updater, but the footprint includes pulling from a mutable remote branch and immediately executing ./setup from the updated repo. The biggest concern is supply-chain trust, amplified by inconsistency between the skill name/repo reference (kai-marketing) and the supplied publisher evidence (kai-cmo-harness).