refactor(kyberforge): make skill-write and skill-audit self-contained with shared resources

- Move validate.sh ownership to skill-audit/scripts/ — it is the canonical
  structural validator; skill-write now delegates Step 5 to /skill-audit
- Add skill-write/references/scripts.md and deployment-modes.md for progressive
  disclosure of package runner patterns and plugin cache isolation rules
- Fix skill-audit Step 1 cross-skill path reference (was repo-absolute, now
  skill-relative); add manual fallback for sandboxed/Bash-denied contexts
- Scope Step 2 "read every file" to exclude binaries and unreferenced files
- Fix new-skill.sh next-steps output to reference /skill-audit instead of
  the removed validate.sh
- Remove stale Dependencies section from skill-audit README; flip dependency
  arrow — skill-write depends on skill-audit, not vice versa

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

plugins/kyberforge/skills/skill-write/references/scripts.md

@@ -0,0 +1,68 @@
+# Scripts Reference
+
+## Package runners (no install required)
+
+When an existing package does what you need, use a runner directly in SKILL.md without writing a script file.
+
+| Runner | Language | Notes |
+|--------|----------|-------|
+| `uvx package@version` | Python | Recommended. Aggressive caching via uv. |
+| `pipx run 'package==version'` | Python | Broader OS availability. |
+| `npx package@version` | Node.js | Ships with npm/Node.js. |
+| `bunx package@version` | Node.js | Bun environments only. |
+| `deno run npm:package@version` | TypeScript | Requires permission flags (`--allow-read`, etc.). |
+| `go run golang.org/x/...@version` | Go | Built into Go toolchain. |
+
+Always pin versions. Never use `pip install` or `npm install -g` at runtime — they are not idempotent and pollute the environment.
+
+## Inline dependency patterns
+
+Use these when the script requires packages but should remain a single portable file.
+
+**Python (PEP 723 + uv):**
+```python
+# /// script
+# dependencies = [
+#   "beautifulsoup4>=4.12,<5",
+# ]
+# requires-python = ">=3.12"
+# ///
+from bs4 import BeautifulSoup
+```
+```bash
+uv run scripts/extract.py
+```
+
+**TypeScript (Deno):**
+```typescript
+#!/usr/bin/env -S deno run
+import * as cheerio from "npm:cheerio@1.0.0";
+```
+```bash
+deno run scripts/extract.ts
+```
+
+**TypeScript (Bun):**
+```typescript
+#!/usr/bin/env bun
+import * as cheerio from "cheerio@1.0.0";
+```
+```bash
+bun run scripts/extract.ts
+```
+
+**Ruby (bundler/inline):**
+```ruby
+require 'bundler/inline'
+gemfile do
+  source 'https://rubygems.org'
+  gem 'nokogiri', '~> 1.16'
+end
+```
+```bash
+ruby scripts/extract.rb
+```
+
+## Output size
+
+Many harnesses truncate tool output beyond 10–30K characters. Default to a summary or a reasonable output limit. For scripts that can produce large output: support `--offset N` for pagination, or use `--output FILE` to write to disk and keep stdout clean.