Skill kit refresh: fix audit findings, add routing, remove okf-bundle

[DocksDocks]

Closes #35

Implements the reviewed plan #35:

• okf-bundle removed - zero inbound references; README productivity line matches the 7-skill post-removal set.
• Lifecycle wording - security and refactor drop untracked markdown plan fallbacks; GitHub-issue-only lifecycle with the full plan:<phase> label set.
• Workflow fixes - fix-workflow gains OWASP A05:2025, a security/code-review finding-field input mapping, and lifecycle routing; dep-vuln playbook two-commit split; tdd-workflow and test-coverage routing repaired; commit-discipline gates every history rewrite on explicit user confirmation and defers plan-branch landing.
• Discipline fixes - Kotlin 1.7+ when-statement exhaustiveness claim corrected; solid strategy map made finite-key exhaustive; code-clarity/solid/type-safety three-way boundary routes mutual.
• UI routing - accessibility dialog focus-restore claim qualified (2.4.13 stays AAA); design-tokenization and react-component-patterns route accessibility.
• Re-vendor - make-interfaces-feel-better re-vendored at pinned upstream 5a4076a under untrusted-content review (no injected instructions; README/agents.yaml deliberately not applied); all divergences enumerated in metadata.patches; new icons reference.

Reviews: plan review rounds 1-3 (repair -> pass -> pass on advisory-amended bytes); code review round 1 pass with one recorded LOW advisory (kotlin sealed same-package wording - follow-up candidate).
Verification: full node scripts/ci.mjs exit 0 with content hashes re-synced.