Match the repository docs to the repository and gate the skill scan

What

The repository-level docs match the repository, and the authored skill gets the same fail-closed skillspector gate the vendored skills already have.

Why

Bare just started a vendor sync that clones upstream, while the README said it printed a menu. The install line used owner/repo shorthand, which Claude Code reads as github.com. AGENTS.md described .reference.yaml fields the file does not hold. A cold skillspector scan of the authored skill reads DO_NOT_INSTALL with nothing saying which findings were reviewed.

How

• The root just default prints a menu; every root recipe has a doc line.
• Install uses the full HTTPS URL, as the Claude Code marketplace docs require for a GitLab host.
• README carries prerequisites and points at the vendored-skill manifest instead of copying the list; AGENTS.md points at CONTRIBUTING instead of restating it; one layout tree, in the README. CLAUDE.md goes: AGENTS.md is the one agent file.
• ADRs: corrections ride the status line, so accepted bodies stay as written; the scan triage and docs/maintenance.md are indexed in docs/README.md; the empty RFC and PRD folders fold into one paragraph.
• just skill-scan runs the pinned scanner with --no-llm and a dependency cutoff, and checks every finding against skill-scan-accept.yml by signature and count: a new finding, an extra one of an accepted class, a signature that stopped firing, a finding with no severity, or a scan that saw fewer files than the skill tracks each fail the gate.
• CI verifies the uv, just, jq and shellcheck downloads against hashes committed in the repository, and runs one static pipeline per push (the MR pipeline when an MR is open).

Verification

• just ci passes; the scan reports 0 problems on main's merged skill.
• Each gate failure was proven in a scratch copy: a planted file with new findings, a duplicated accepted pattern, a ghost accepted row, an empty copy and a severity-less finding each exit 1.