t3-provision-users: vendor agent skills + per-user install_skills (emo)

Make the admin's Claude Code agent skills available to the `emo` devvm user.
Viktor asked to install Matt Pocock's skills for emo, starting with grill-me
but covering the full set the admin already uses.

The `npx skills` upstream has drifted off that set (diagnose -> diagnosing-bugs
and write-a-skill -> writing-great-skills were renamed; caveman + zoom-out are
no longer published), so reproducing it via npx is impossible and would also
spray ~70 agent dirs into the user's home + add a GitHub-clone + unpinned-CLI
dependency to the hourly root reconcile. Instead vendor a point-in-time
snapshot of the 16 skills (scripts/workstation/claude-skills/) and copy them
per-user, mirroring install_memory: install_skills() copies each skill into
~/.agents/skills/<name> (owned by the user) and symlinks
~/.claude/skills/<name> -> ../../.agents/skills/<name>. if-absent, additive,
best-effort, scoped to the SKILL_USERS allowlist (emo).

find-skills is from vercel-labs/skills (not Matt Pocock) but included since it
is part of the admin's current set.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/workstation/claude-skills/README.md

@@ -0,0 +1,31 @@
+# claude-skills — vendored agent-skill snapshot
+
+Point-in-time snapshot of the admin's (`wizard`) Claude Code agent skills, deployed
+per-user by `install_skills()` in `../../t3-provision-users.sh` (scoped to the
+`SKILL_USERS` allowlist). Each subdirectory is one skill (`SKILL.md` + any bundled
+references). The provisioner copies a skill into `~/.agents/skills/<name>/` (owned by
+the user) and symlinks `~/.claude/skills/<name> -> ../../.agents/skills/<name>` — the
+layout the `skills` CLI's `-g` install produces; Claude Code reads `~/.claude/skills/`.
+
+## Why vendored (not `npx skills add` at provision time)
+
+Upstream drifted from this set: on `mattpocock/skills` master, `diagnose` →
+`diagnosing-bugs` and `write-a-skill` → `writing-great-skills` were renamed, and
+`caveman` + `zoom-out` are no longer published — so `npx skills` cannot reproduce this
+exact set. Vendoring is also offline/deterministic and keeps GitHub-clone +
+unpinned-CLI dependencies out of the hourly **root** reconcile.
+
+## Sources
+
+- `mattpocock/skills` (https://github.com/mattpocock/skills) — all except `find-skills`
+- `vercel-labs/skills` (https://github.com/vercel-labs/skills) — `find-skills`
+
+## Refreshing
+
+Re-snapshot from a current install and commit the diff:
+
+```sh
+cp -a ~/.agents/skills/. scripts/workstation/claude-skills/
+```
+
+Snapshot taken 2026-06-23.