Add Skills Hub — universal skill search, install, and management from online registries

Implements the Hermes Skills Hub with agentskills.io spec compliance,
multi-registry skill discovery, security scanning, and user-driven
management via CLI and /skills slash command.

Core features:
- Security scanner (tools/skills_guard.py): 120 threat patterns across
  12 categories, trust-aware install policy (builtin/trusted/community),
  structural checks, unicode injection detection, LLM audit pass
- Hub client (tools/skills_hub.py): GitHub, ClawHub, Claude Code
  marketplace, and LobeHub source adapters with shared GitHubAuth
  (PAT + gh CLI + GitHub App), lock file provenance tracking, quarantine
  flow, and unified search across all sources
- CLI interface (hermes_cli/skills_hub.py): search, install, inspect,
  list, audit, uninstall, publish (GitHub PR), snapshot export/import,
  and tap management — powers both `hermes skills` and `/skills`

Spec conformance (Phase 0):
- Upgraded frontmatter parser to yaml.safe_load with fallback
- Migrated 39 SKILL.md files: tags/related_skills to metadata.hermes.*
- Added assets/ directory support and compatibility/metadata fields
- Excluded .hub/ from skill discovery in skills_tool.py

Updated 13 config/doc files including README, AGENTS.md, .env.example,
setup wizard, doctor, status, pyproject.toml, and docs.

hermes_cli/setup.py

@@ -199,6 +199,12 @@ def _print_setup_summary(config: dict, hermes_home):
     else:
         tool_status.append(("RL Training (Tinker)", False, "TINKER_API_KEY"))
     
+    # Skills Hub
+    if get_env_value('GITHUB_TOKEN'):
+        tool_status.append(("Skills Hub (GitHub)", True, None))
+    else:
+        tool_status.append(("Skills Hub (GitHub)", False, "GITHUB_TOKEN"))
+    
     # Terminal (always available if system deps met)
     tool_status.append(("Terminal/Commands", True, None))
     
@@ -1103,6 +1109,36 @@ def run_setup_wizard(args):
                 else:
                     print_warning("    Partially configured (both keys required)")
     
+    # =========================================================================
+    # Step 9: Skills Hub (Optional)
+    # =========================================================================
+    print_header("Skills Hub (Optional)")
+    print_info("A GitHub token enables higher API rate limits for skill search/install,")
+    print_info("and is required for publishing skills via GitHub PRs.")
+    print()
+
+    github_configured = get_env_value('GITHUB_TOKEN')
+    if github_configured:
+        print_success("  GitHub token: configured ✓")
+        choice = prompt("  Reconfigure? (y/N)", default="n")
+        if choice.lower() == 'y':
+            token = prompt("    GitHub Token (ghp_...)", password=True)
+            if token:
+                save_env_value("GITHUB_TOKEN", token)
+                print_success("    Updated")
+    else:
+        print_warning("  GitHub token: not configured (60 req/hr rate limit)")
+        choice = prompt("  Configure now? (y/N)", default="n")
+        if choice.lower() == 'y':
+            print_info("  Get a token at: https://github.com/settings/tokens")
+            print_info("  Recommended: Fine-grained token with Contents + Pull Requests permissions")
+            token = prompt("    GitHub Token", password=True)
+            if token:
+                save_env_value("GITHUB_TOKEN", token)
+                print_success("    Configured ✓")
+            else:
+                print_info("    Skipped — you can add it later in ~/.hermes/.env")
+
     # =========================================================================
     # Save config and show summary
     # =========================================================================