feat(skills): name cicd composer traps

[daniellam258]

Why

Downstream dopamint-arena#1037 / DOPAN-1118. The host-runnable contract already said "prefer TypeScript + bun" in one line. A full extract of fat YAML run: blocks showed four gaps:

1. Language was a preference, not a default with a named home for shell.
2. Extracting a step left YAML-body contract pins and path-filter lists on the old site.
3. A test-evidence gate that scans for fail treated 0 fail as a non-passing claim.
4. A shared mutating CLI had no stated refuse-without-confirm rule for laptop and CI.

What changed

cmk:cicd 0.3.3.

• Language (references/host-runnable.md) — TypeScript + bun (or the repo's existing runtime) is the default for programmable steps. Shell is host bootstrap only. Do not add a third ops language. Convert by replace, not shim.
• composer-contract drift — YAML becomes a one-line invoke; contracts retarget to the script; path-filter unions stay derived from one source of truth. Do not raise a line-count baseline to keep leftover YAML.
• evidence-floor negation (references/policy-and-auth.md) — match a verdict, not the substring fail.
• Mutate gate — --confirm locally or a documented CI env; absence is refuse. A GitHub Environment is not a substitute on a laptop.
• CI self-contract tests pin the implementation site. ## Verify names the language and mutate-gate checks.

Testing

bash scripts/skill-lint.sh

skill-lint: OK (frontmatter, size, references, citations, paths, eval.json across skills/).