Add Skills Hub — universal skill search, install, and management from online registries

Implements the Hermes Skills Hub with agentskills.io spec compliance,
multi-registry skill discovery, security scanning, and user-driven
management via CLI and /skills slash command.

Core features:
- Security scanner (tools/skills_guard.py): 120 threat patterns across
  12 categories, trust-aware install policy (builtin/trusted/community),
  structural checks, unicode injection detection, LLM audit pass
- Hub client (tools/skills_hub.py): GitHub, ClawHub, Claude Code
  marketplace, and LobeHub source adapters with shared GitHubAuth
  (PAT + gh CLI + GitHub App), lock file provenance tracking, quarantine
  flow, and unified search across all sources
- CLI interface (hermes_cli/skills_hub.py): search, install, inspect,
  list, audit, uninstall, publish (GitHub PR), snapshot export/import,
  and tap management — powers both `hermes skills` and `/skills`

Spec conformance (Phase 0):
- Upgraded frontmatter parser to yaml.safe_load with fallback
- Migrated 39 SKILL.md files: tags/related_skills to metadata.hermes.*
- Added assets/ directory support and compatibility/metadata fields
- Excluded .hub/ from skill discovery in skills_tool.py

Updated 13 config/doc files including README, AGENTS.md, .env.example,
setup wizard, doctor, status, pyproject.toml, and docs.

docs/cli.md

@@ -294,3 +294,38 @@ For verbose output (debugging), use:
 ```bash
 ./hermes --verbose
 ```
+
+## Skills Hub Commands
+
+The Skills Hub provides search, install, and management of skills from online registries.
+
+**Terminal commands:**
+```bash
+hermes skills search <query>                      # Search all registries
+hermes skills search <query> --source github      # Search GitHub only
+hermes skills install <identifier>                # Install with security scan
+hermes skills install <id> --category devops      # Install into a category
+hermes skills install <id> --force                # Override caution block
+hermes skills inspect <identifier>                # Preview without installing
+hermes skills list                                # List all installed skills
+hermes skills list --source hub                   # Hub-installed only
+hermes skills audit                               # Re-scan all hub skills
+hermes skills audit <name>                        # Re-scan a specific skill
+hermes skills uninstall <name>                    # Remove a hub skill
+hermes skills publish <path> --to github --repo owner/repo
+hermes skills snapshot export <file.json>         # Export skill config
+hermes skills snapshot import <file.json>         # Re-install from snapshot
+hermes skills tap list                            # List custom sources
+hermes skills tap add owner/repo                  # Add a GitHub repo source
+hermes skills tap remove owner/repo               # Remove a source
+```
+
+**Slash commands (inside chat):**
+
+All the same commands work with `/skills` prefix:
+```
+/skills search kubernetes
+/skills install openai/skills/skill-creator
+/skills list
+/skills tap add myorg/skills
+```