geobase-worker-osm-import

Mostly coherent Geobase workflow: purpose, permissions, and network destinations align with OSM import job submission, and secrets are intended to stay local and go only to first-party Geobase APIs. The main concern is reliance on a not-clearly-verifiable geobase-cli dependency; that makes the skill suspicious from an install/trust standpoint, but there is no strong evidence of malicious intent or credential exfiltration.