docs: lead with two-doors positioning (CLI · skill · plugin)

[nabsha]

The README/SKILL lead agent-first, which causes recurring "why install this as a skill / why not just a plugin?" confusion (it came up repeatedly).

Reframe the umbrella README + skill README to lead with the audiences:

• CLI for you — a .env-replacement you run at your terminal (a human doesn't need the "skill" framing).
• Skill for your agent, everywhere — the portable AgentSkills artifact (Claude Code, Agent SDK, claude.ai, OpenClaw).
• Plugin for Claude Code — the enforced superset (guard hook + MCP + /kdbx:*) that bundles the skill.

Key facts to surface: plugins are Claude-Code-only, so the skill is the portable core; the agent's real value is run/check (use secrets without seeing them). Resolves the "why a skill" + "why not plugin-only" questions for the next reader.