Add Skills Hub — universal skill search, install, and management from online registries

Implements the Hermes Skills Hub with agentskills.io spec compliance,
multi-registry skill discovery, security scanning, and user-driven
management via CLI and /skills slash command.

Core features:
- Security scanner (tools/skills_guard.py): 120 threat patterns across
  12 categories, trust-aware install policy (builtin/trusted/community),
  structural checks, unicode injection detection, LLM audit pass
- Hub client (tools/skills_hub.py): GitHub, ClawHub, Claude Code
  marketplace, and LobeHub source adapters with shared GitHubAuth
  (PAT + gh CLI + GitHub App), lock file provenance tracking, quarantine
  flow, and unified search across all sources
- CLI interface (hermes_cli/skills_hub.py): search, install, inspect,
  list, audit, uninstall, publish (GitHub PR), snapshot export/import,
  and tap management — powers both `hermes skills` and `/skills`

Spec conformance (Phase 0):
- Upgraded frontmatter parser to yaml.safe_load with fallback
- Migrated 39 SKILL.md files: tags/related_skills to metadata.hermes.*
- Added assets/ directory support and compatibility/metadata fields
- Excluded .hub/ from skill discovery in skills_tool.py

Updated 13 config/doc files including README, AGENTS.md, .env.example,
setup wizard, doctor, status, pyproject.toml, and docs.

TODO.md

@@ -185,10 +185,10 @@ _todo_tool_calls_since_update: int  # counter for checkpoint nudges
 
 ## 3. Dynamic Skills Expansion 📚
 
-**Status:** Partially implemented (41 read-only skills exist)
-**Priority:** Medium
+**Status:** IMPLEMENTED — Skills Hub with search/install/publish/snapshot from 4 registries
+**Priority:** ~~Medium~~ Done
 
-Extend the skills system so the agent can create, edit, and delete skills at runtime. Skill acquisition from successful task patterns.
+Skills Hub implemented: search/install/inspect/audit/uninstall/publish/snapshot across GitHub repos, ClawHub, Claude Code marketplaces, and LobeHub. Security scanner with trust-aware policy (builtin/trusted/community). CLI (`hermes skills ...`) and `/skills` slash command. agentskills.io spec compliant.
 
 **What other agents do:**
 - **OpenClaw**: ClawHub registry -- bundled, managed, and workspace skills with install gating. Agent can auto-search and pull skills from a remote hub.
@@ -943,7 +943,7 @@ This goes in the tool description:
 6. Subagent Architecture -- #1 (partially solved by #20)
 7. MCP Support -- #14
 8. Interactive Clarifying Questions -- #4
-9. Dynamic Skills Expansion (create/edit/delete) -- #3
+9. ~~Dynamic Skills Expansion~~ -- #3 (DONE: Skills Hub)
 
 **Tier 3 (Quality of life, polish):**
 10. Permission / Safety System -- #15