fix(skills): stop auto-saving exploration transcripts as procedure skills

[jkyberneees]

Problem

Auto-saved skills like procedure-ls were raw session transcripts: 19 steps of ls/grep/sed -n exploration plus full git commit -m messages, with junk trigger keywords. Two holes in the pipeline let them through:

1. DetectMultiStepProcedure had no substance bar — any 4+ contiguous successful shell calls became a "procedure" skill. The quality gate only checks for ## Overview / ## Common Pitfalls sections, which the generated template always contains.
2. The recurrence gate was defeated by generic fingerprints — candidateFingerprint was just heuristic|name, and the name is procedure-<first command verb>. Any two unrelated sessions starting with ls both produced multi-step|procedure-ls, so min_occurrences: 2 passed within days.

Fix

• Substance bar in buildSuggestionFromSequence: reject sequences where any step is multi-line or > 200 chars (embedded commit messages, heredocs — session payloads that can never be replayed), or where read-only inspection verbs (ls, grep, cat, head, sed -n, echo, git status/log/diff, go test/vet, …) make up more than half the steps — an exploration transcript, not a reusable procedure.
• Content-keyed recurrence fingerprint: heuristic|name|sha256(normalized command log)[:12] — only the same normalized command pattern seen again counts as a recurrence; generic names no longer collide across unrelated sessions.

Tests

• Rejects an exploration transcript modeled on the reported procedure-ls skill
• Rejects oversized (git commit -m …) and multi-line (heredoc) steps
• Accepts a genuine build/tag/push release sequence
• No false recurrence: two sessions sharing the name procedure-ls with different command logs stay pending
• TestRunLearn_* E2E mock now drives an action verb (true step N) — echo is correctly classified as inspection
• go test ./internal/skills/, go vet, golangci-lint all clean

Note: TestApproveMCPServers_ProjectServerRequiresApproval fails locally in full-package runs on this machine, but it also fails on a clean checkout of main (verified via git stash) — pre-existing local environment issue, unrelated to this change.