simplify-and-harden-ci

SUSPICIOUS leaning but not malicious: the skill’s behavior is largely coherent with CI code review on GitHub, and its network/data flows stay within official GitHub tooling. The main issue is transitive trust: it asks the agent to install a third-party skill from a personal repo, with an `npx` fallback and some unpinned install references. Overall this is a medium-risk workflow integration skill, not a credential harvester or exfiltration skill.