feat: publish multi-marketplace community pack

[AlexMikhalev]

Summary

• publish the three Apache-2.0 Community introduction skills for Cursor, Kimi Code, AutoClaw, ZCode, Hermes Agent, skills.sh, and Claude Code
• generate all host manifests from one canonical metadata file and build deterministic, checksummed AutoClaw archives
• document signed Terraphim v1.21.14 dependencies, neutral Community/Core/Premium discovery, bilingual install guidance, UAT, and submission collateral with V-model assets
• add fail-closed CI and a signed-tag release workflow with exact action pins, read/write permission separation, and non-persisted checkout credentials

Validation

• 22 contract/regression tests pass
• Ruff lint/format, actionlint, Markdown structure lint, and git diff checks pass
• Claude Code strict validation and isolated install pass
• Kimi 1.44 isolated install passes
• skills.sh discovers exactly three skills
• all three skills pass tsm validate and trusted-key verification
• Z.ai's official validator and release builder accept the staged plugin
• AutoClaw archives reproduce byte-for-byte and pass SHA-256 verification
• independent structured review: PASS 4.8/5, no P0/P1/P2 findings

Boundaries

Curated acceptance remains controlled by each marketplace. AutoClaw desktop import and a full Hermes invocation remain explicitly recorded as external UAT items; Hermes public discovery was blocked locally by GitHub's unauthenticated API rate limit.