chore: address Copilot review round 15

- The CI wiring guard matched a substring, and last round's justification for
  that was wrong: it accepts a longer script name
  (`npm run verify:skills:cli:disabled`) and a mere mention (`echo npm run
  verify:skills:cli`), either of which lets the real validator be removed while
  the guard stays green. `runsCommand` now splits the script on the separators
  that begin a new command and requires a segment to equal the invocation
  exactly, with both counterexamples as regression cases.
- `local-dev`'s own description and its AGENTS.md index row both still promised
  "where a new dependency must be declared" — the rules round 13 moved out of it
  entirely. Both now describe what the skill actually carries: the reasoning
  behind those rules. Recorded listing share updated to 1,199/4,000.

Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/verify-skills.main.test.mjs

@@ -24,7 +24,11 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
-import { checkWiring, ciRunsUnconditionally } from "./verify-skills.mjs";
+import {
+  checkWiring,
+  ciRunsUnconditionally,
+  runsCommand,
+} from "./verify-skills.mjs";
 
 const SCRIPT = path.join(
   path.dirname(fileURLToPath(import.meta.url)),
@@ -342,3 +346,41 @@ test("the repository's workflow runs the validator unconditionally", () => {
     true,
   );
 });
+
+test("runsCommand matches an exact invocation, not a substring", () => {
+  const C = "npm run verify:skills:cli";
+  for (const script of [
+    C,
+    `npm run validate && ${C}`,
+    `npm run validate\n${C}\n`,
+    `${C} ; npm run something`,
+  ]) {
+    assert.equal(runsCommand(script, C), true, script);
+  }
+});
+
+test("runsCommand rejects a longer script name or a mere mention", () => {
+  // Both would let the real validator be removed while the wiring guard stayed
+  // green — the counterexamples to the substring test this replaced.
+  const C = "npm run verify:skills:cli";
+  for (const script of [
+    "npm run verify:skills:cli:disabled",
+    "echo npm run verify:skills:cli",
+    "npm run verify:skills",
+    "npm run verify:skills:cli --silent",
+    "",
+  ]) {
+    assert.equal(runsCommand(script, C), false, script);
+  }
+});
+
+test("ciRunsUnconditionally inherits the exact-invocation rule", () => {
+  const C = "npm run verify:skills:cli";
+  assert.equal(
+    ciRunsUnconditionally(
+      "jobs:\n  build:\n    steps:\n      - run: npm run verify:skills:cli:disabled\n",
+      C,
+    ),
+    false,
+  );
+});