mj-notes-workflow

SUSPICIOUS: the core note-processing purpose is coherent, and the `getnote` CLI appears to be an official documented dependency, so this is not strong malware evidence. Risk comes from credential use through an external CLI, writable local/remote side effects, untrusted note content feeding later actions, and especially unverified transitive skill delegation (`mj-writer`/`mj-deploy`/`mj-cf-dns`).