chore: address Copilot review round 5

- verify-skills-cli: use a local CLI only when it matches the pin EXACTLY. A
  floor let a maintainer on a newer CLI validate against a different schema than
  CI's, so the same `local:gate` could disagree across machines — the failure a
  pin exists to prevent.
- verify-skills-cli: extract `runValidator({probe, spawn, log, error})` and
  cover the orchestration — validator accepts, validator rejects, spawn fails,
  and the three unusable-probe shapes. On a machine with a working CLI an actual
  run only ever walks the happy path.
- pr-flow: stop putting the `gh` token in curl's argv, where any local process
  can read it off the process table. Feed the header through `curl --config -`.
- docs/quality-gate: three places had drifted — the CI tier row, the
  `local:gate` chain, and the `test:scripts` inventory (which now names all four
  suites this PR adds, not two).

Signed-off-by: cliffhall <cliff@futurescale.com>

AGENTS.md

@@ -156,9 +156,12 @@ that from happening:
    That best-effort hand-off keeps `validate` fast and offline, but it also
    means it usually does not run — so the authoritative check gets a **guaranteed
    step of its own**, `npm run verify:skills:cli`, in `local:gate` and in CI.
-   It resolves the CLI rather than hoping for one: an installed CLI when it is
-   new enough, otherwise a **pinned** one via `npx -y`. Both tiers run the same
-   script, so they cannot drift.
+   It resolves the CLI rather than hoping for one: an installed CLI **only when
+   it matches the pin exactly**, otherwise the pinned package via `npx -y`.
+   Exact rather than a floor, because a newer local CLI is a *different* schema
+   from CI's — accepting it would let the same `local:gate` disagree across
+   machines, which is what a pin exists to prevent. Both tiers run the same
+   script, so they cannot drift either.
    ⚠️ Frontmatter is only read when the opening `---` is the file's **first
    line** — no BOM, no leading blank line.
 2. **Every skill declares its invocation mode explicitly.**