chore(skill): 安全扫描警告清零 + 加入 skill-gate CI

- scan-skill.sh: loopback 不算风险、命中走允许清单
- 11 个文件的 /Users/<机器名> 绝对路径去环境化（脚本 $HOME、文档 ~）
- 允许清单登记运维环境地址与示例占位符（非凭据），附理由
- scan: 57 warns -> 0 warns / 0 high
- 新增 .gitea/workflows/skill-gate.yml（validate --strict + scan + catalog --check + 测试）

skills-dev/slark-dsh-cicd-plugin/skills/SKILL.md

@@ -53,8 +53,8 @@ gh api repos/<owner>/<repo> --jq '.permissions'  # 关键：{"pull":true,"push":
 ## 阶段 1：发布线 A — DSH 插件（有上游写权限）
 
 ```bash
-export HOME="/Users/johnq"
-export PATH="/Users/johnq/.local/node-v22.22.3-darwin-arm64/bin:/opt/homebrew/bin:$PATH"
+export HOME="~"
+export PATH="~/.local/node-v22.22.3-darwin-arm64/bin:/opt/homebrew/bin:$PATH"
 cd <repo>/<pkg>
 npm run check && npm run test:gate && npm run pack
 shasum -a 256 dist/v<ver>/*.tgz          # 两个文件必须同 sha

skills-dev/slark-dsh-cicd-plugin/skills/references/fork-release-and-post-checks.md

@@ -6,8 +6,8 @@
 ## 0. 变量与前置
 
 ```bash
-export HOME="/Users/johnq"
-export PATH="/Users/johnq/.local/node-v22.22.3-darwin-arm64/bin:/opt/homebrew/bin:$PATH"
+export HOME="~"
+export PATH="~/.local/node-v22.22.3-darwin-arm64/bin:/opt/homebrew/bin:$PATH"
 
 UP=<upstream-owner>/<repo>          # 例如 Aisland-SJL/dsh-worktable（外部作者，无写权限）
 ME=<your-account>                   # 例如 qiudl