chore: harden repo security controls

[jcarlosrodicio]

Summary

What changed and why?

Type of change

• Documentation
• Agent/command prompt
• Skill/tool integration
• Docker/Open Design setup
• Install/uninstall scripts
• Validation/checks
• Other

Checklist

• I ran npm run check.
• I updated README/docs for any public behavior changes.
• I did not commit secrets, auth files, sessions, logs, private product docs, or local paths.
• I preserved the distinction between bundled local skills, upstream plugins, and optional user-installed skills.
• I kept normal free-form requests separate from slash-command orchestration flows.

Notes for reviewers

Anything that deserves extra attention?