feat(scripts): add orchestrator verification script for read-only setup

feat(docs): add tools-expert skill support and explicit permissions

feat(auditor): add skill permissions with orchestration-governance deny

feat(flow): add explicit skill permissions with orchestration-governance, core-build and tools-expert deny

feat(builder): add explicit skill permissions with orchestration-governance and flows deny

fix(orchestrator): update skill permissions to use explicit deny instead of wildcard

fix(install): replace wildcard skill deny with explicit permissions in agent transformation

docs(orchestrator): add reasoning and question-tool gates

docs(agents): enforce skill-first execution before tools

fix(installer): add resilient full-skill download fallbacks

fix(installer): fetch full skill packages in standalone installs

docs(orchestrator): clarify governance-first vertical subagent routing

fix(installer): install canonical templates and prune legacy skills

chore(gitignore): ignore local opencode and claude config dirs

fix(installer): keep component counts numeric during skill install errors