chore: address Copilot review round 9

- Enrol both skill gates in the repo's gate-integrity vouch cycle. A gate that
  stops being invoked fails silently with every fixture test green, which is the
  failure the existing cycle exists to prevent. `verify:format-coverage` now
  vouches for `verify:skills`, `verify:skills` vouches back, and it additionally
  asserts the two links nothing else could see: `verify:skills:cli` present in
  `local:gate` and in the workflow — neither is reachable from `validate` or
  from any test. `checkWiring` is pure and unit-tested, with a live case against
  the real package.json and workflow so the fixtures cannot drift. All four
  links verified by mutation.
- The existing sibling-vouch fixture is now a table over every sibling, so
  adding a fourth guard later does not need a new test.
- release skill: stop hard-coding `2.3.0`, which has already shipped — the tag
  command aborted on an existing tag and the branch template named the wrong
  release. Both now read the version from `package.json` (the tag from
  `origin/main`'s), with a warning never to copy a version out of the file.

Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/verify-format-coverage.mjs

@@ -166,15 +166,19 @@ function trackedSourceFiles() {
   return out.split("\n").filter(Boolean);
 }
 
-// Vouch for the sibling guards: a guard can't detect being unrun itself, so the
-// three form a cycle instead. This one checks BOTH others; each of them checks
-// only this one. So dropping `verify:typecheck-coverage` or
-// `verify:dep-lockstep` is caught here, and dropping *this* guard is caught by
-// either of them. Only removing all three at once slips through.
+// Vouch for the sibling guards: a guard can't detect being unrun itself, so they
+// form a cycle instead. This one checks the others; each of them checks only
+// this one. So dropping `verify:typecheck-coverage`, `verify:dep-lockstep` or
+// `verify:skills` is caught here, and dropping *this* guard is caught by any of
+// them. Only removing all of them at once slips through.
 const rootScripts = JSON.parse(
   readFileSync(path.join(repoRoot, "package.json"), "utf8"),
 ).scripts;
-for (const sibling of ["verify:typecheck-coverage", "verify:dep-lockstep"]) {
+for (const sibling of [
+  "verify:typecheck-coverage",
+  "verify:dep-lockstep",
+  "verify:skills",
+]) {
   if (rootReachesScript(rootScripts, sibling)) continue;
   console.error(
     `verify:format-coverage — the root \`validate\` no longer runs \`${sibling}\` (its sibling guard). Restore it.`,