chore: SOTA audit fixes – catalog recursive, readme regex, docs, CI, installer

- P0: Catalog includes nested skills (listSkillIdsRecursive), 626 skills
- P0: update_readme.py regex fixes 'high-performance agentic skills'
- P1: SKILL_ANATOMY risk values aligned to none|safe|critical|offensive (EN + vi)
- P1: requirements.txt + CONTRIBUTING Python setup
- P1: data/package.json version 4.6.0
- P2: npm run test + CI test step; validator docs + validation-baseline in .gitignore
- P3: Installer --version/--tag support; CI npm audit; __pycache__ in .gitignore

.gitignore

@@ -1,4 +1,5 @@
 node_modules/
+__pycache__/
 .worktrees/
 
 walkthrough.md
@@ -25,3 +26,6 @@ scripts/*voltagent*.py
 scripts/*html*.py
 scripts/*similar*.py
 scripts/*count*.py
+
+# Optional baseline for legacy JS validator (scripts/validate-skills.js)
+validation-baseline.json