feat(skills): deterministic dispatch for every devkit workflow

[5uck1ess]

Summary

Every devkit workflow now has a natural-language trigger skill so keyword-driven invocation is deterministic. Saying "build me a feature", "tri review", "deep research X", "self-lint this", etc., reliably dispatches to the matching workflow via CC's Skill tool → devkit_start → engine. Closes the entry-gate gap where 11/18 workflows had no natural-language path at all.

• 14 new trigger skills: feature, bugfix, refactor, audit, tri-review, tri-debug, tri-security, tri-dispatch, self-audit, self-improve, self-lint, self-migrate, self-perf, self-test. Each is ~15 lines — keyword-rich frontmatter + a one-line devkit_start body. No duplication of workflow logic.
• 3 new workflow YAMLs — test-gen.yml, doc-gen.yml, onboard.yml — so the existing test-gen, doc-gen, onboard skills have engine-enforced step machines to dispatch to instead of 60–100-line honor-system step content.
• 3 content skill rewrites — test-gen, doc-gen, onboard shrunk to ~14 lines each (thin dispatchers), net −225 lines.
• Guard fix — src/cmd/guard.go command+hard and prompt+hard allowlists now include Skill, so a nested "do tri-review" inside an active feature workflow actually loads the trigger skill instead of being silently blocked. Two new pinning test rows.
• Engine sanity test — src/engine/new_workflows_test.go walks every workflows/*.yml through ParseFile + Validate so a malformed workflow fails in CI rather than at first devkit_start.
• Reference hygiene — skills/creating-workflows description relabelled REFERENCE ONLY so the matcher can't fire it on natural-language task requests. It's schema docs for writing workflow YAML, not a runnable.
• Docs — README workflow count 18→21, skill count 22→36, rewrote Skills section with a per-workflow trigger table. ROADMAP updated accordingly.

Why

Before this PR: the devkit engine was 100% deterministic once devkit_start fired, but only 4 of 18 workflows had natural-language triggers (research, deep-research, pr-ready, autoloop). The other 14 could only be fired via slash command or by the agent inferring intent from context — which is probabilistic and routinely drifted. The engine's determinism guarantee stopped at the entry gate.

After this PR: every workflow has a keyword path. The entry gate is ~99% deterministic (skill matching is LLM-decision but descriptions are tight enough that natural phrasing reliably matches). Once devkit_start fires, the existing guard + stop-guard guarantee remains unchanged — step order, no skipping, no early exit. The net effect is end-to-end determinism: you say the keyword, the workflow runs every step.

The honest 1% left: novel phrasings no description anticipates. Recommended fallback is the slash commands (/devkit:tri-review, /devkit:tri-debug, /devkit:tri-security, /devkit:workflow) which bypass the matcher entirely via CC's exact-string resolver.

mega-pr intentionally stays as a skill (not a workflow) because its "steps" are "fire two external skills in parallel" which doesn't fit the engine's step model.

Test plan

• go test ./... — all 5 packages green including new Skill policy rows
• go test ./engine/... -run TestParseAllShippedWorkflows — 21/21 workflow YAMLs parse + validate
• bash hooks/hooks_test.sh — 52/52 pass
• go vet ./... + gofmt -l — clean
• CI green across lint / go test / hooks smoke / cross-platform matrix
• Manual: in a fresh CC window after plugin upgrade, say "build me a feature for red color support" and confirm the feature skill fires and devkit_start feature is called without the user having to type the slash command
• Manual: verify nested skill dispatch — start a feature workflow, then mid-run say "do tri-review on the diff", confirm the tri-review skill loads (previously blocked by the guard)