feat: add Skill Capsule routing

[chu459]

Summary

Closes #26.

Thanks @rfdiosuao for the detailed feature request and acceptance criteria.

This PR adds v0.8.0 Skill Capsule routing for Claude Code workers:

• first-run/local Skill index and human-readable Skill manual
• stable skill-route and compact skill-capsule
• --skills auto for run, run-streaming, spawn-role-team, and mock workflow-run
• MCP tools: cc_skill_index, cc_skill_manual, cc_skill_route, cc_skill_capsule, cc_skill_status
• run/team/workflow metadata for selected skills, hashes, selection reasons, modes, context bytes, and capsule refs
• path-safe public Skill outputs using root aliases and relative refs
• pruned scanning for .git, node_modules, virtualenvs, build output, symlinks, and junctions
• updated README, Chinese README, docs site changelog/CLI/MCP docs, and promo article

Evidence

• python -m py_compile scripts\cc-orchestrator\cc_orchestrator.py scripts\cc-orchestrator\server.py passed
• python scripts\cc-orchestrator\cc_orchestrator.py selftest passed with new gates for path safety, root aliases, ID collision protection, pruned scanning, linked script safety, Skill routing, and workflow metadata
• python scripts\cc-orchestrator\cc_orchestrator.py skill-index --refresh --cwd . passed: skill_count=110, skipped=19, no user/repo absolute path in output
• python scripts\cc-orchestrator\cc_orchestrator.py skill-route --task "Audit Browser connector and GitHub app access" --role security --cwd . passed: selected_count=3, no path field, no user absolute path
• python scripts\cc-orchestrator\cc_orchestrator.py skill-capsule --task "Audit Browser connector and GitHub app access" --role security --cwd . passed: compact capsule, relative capsule ref, no user/repo absolute path
• npm run docs:build passed
• git diff --check passed
• tracked secret pattern scan passed with no matches

Review Notes

Two sub-agent rounds reviewed this. The first critic caught absolute Skill path exposure, unpruned recursive scanning, unstable IDs, and missing top-level workflow routing metadata. This PR fixes those and adds selftest coverage.

One remaining non-blocking note: older workflow APIs still expose absolute cwd / workflow artifact paths as part of the existing local-controller API. The new path-safety guarantee here is scoped to public Skill routing outputs and worker-facing capsules.