devvm: vendor cluster-health into per-user agent-skill snapshot

Make cluster-health a user-global skill for emo (the lone entry in the
provisioner's SKILL_USERS allowlist), so it's available from any directory
— not only when working inside the infra clone where it already exists as a
project skill (.claude/skills/cluster-health). install_skills() in
t3-provision-users.sh copies the vendored snapshot into ~/.agents/skills/ and
symlinks ~/.claude/skills/, so this is the durable, rebuild-surviving path.

cluster-health is homelab-local (vendored from this repo's own
.claude/skills/), unlike the other snapshot entries which mirror upstream
mattpocock/skills + vercel-labs/skills; README documents its provenance and
the explicit re-sync step so the vendored copy doesn't silently drift.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/workstation/claude-skills/README.md

@@ -19,13 +19,24 @@ unpinned-CLI dependencies out of the hourly **root** reconcile.
 
 - `mattpocock/skills` (https://github.com/mattpocock/skills) — all except `find-skills`
 - `vercel-labs/skills` (https://github.com/vercel-labs/skills) — `find-skills`
+- **homelab-local** — `cluster-health` is vendored from this repo's own
+  `.claude/skills/cluster-health/` (the canonical copy, a project skill in the
+  infra clone). It is NOT in `~/.agents/skills/`, so the `cp -a` refresh below
+  does NOT update it — re-copy it explicitly when the canonical skill changes
+  (see Refreshing).
 
 ## Refreshing
 
-Re-snapshot from a current install and commit the diff:
+Re-snapshot the upstream skills from a current install and commit the diff:
 
 ```sh
 cp -a ~/.agents/skills/. scripts/workstation/claude-skills/
 ```
 
-Snapshot taken 2026-06-23.
+Re-sync the homelab-local skill(s) from their canonical in-repo copy:
+
+```sh
+cp -a .claude/skills/cluster-health scripts/workstation/claude-skills/
+```
+
+Snapshot taken 2026-06-23 (upstream); `cluster-health` vendored 2026-06-26.