adopt-standards

SUSPICIOUS. The visible bootstrap is small, but its core behavior is to transfer execution authority to a release-selected downstream skill, including a mutable latest-release path when no version is provided. That transitive trust and deferred repository mutation are broader than a simple local helper, though there is no direct evidence here of credential theft or explicit exfiltration.