fix: harden skill template contracts and scaffolding

Align scaffold slug replacement, Action manifest strict boundaries, metadata prune API, field permission validation, and task_logs readonly semantics with documented template contracts.

Co-authored-by: Cursor <cursoragent@cursor.com>

tools/scaffold_skill.ps1

@@ -71,7 +71,8 @@ if ($targetExists) {
 
 $excludeDirs = @(".git", ".pytest_cache", "__pycache__")
 $excludeFiles = @(".env", ".env.local")
-$templatePlaceholderSlug = "your-skill-slug"
+$templatePlaceholderSlugKebab = "your-skill-slug"
+$templatePlaceholderSlugUnderscore = "your_skill_slug"
 $textFileSuffixes = @(".md", ".py", ".json", ".yaml", ".yml", ".txt", ".ini", ".ps1", ".sample")
 
 function Copy-TemplateTree {
@@ -104,6 +105,7 @@ function Replace-TemplatePlaceholders {
         [string]$Root,
         [string]$Slug
     )
+    $underscoreSlug = $Slug.Replace("-", "_")
     Get-ChildItem -LiteralPath $Root -Recurse -File -Force | ForEach-Object {
         $name = $_.Name
         if ($excludeFiles -contains $name) { return }
@@ -115,8 +117,12 @@ function Replace-TemplatePlaceholders {
         catch {
             return
         }
-        if ($text -notlike "*$templatePlaceholderSlug*") { return }
-        $updated = $text.Replace($templatePlaceholderSlug, $Slug)
+        if (
+            $text -notlike "*$templatePlaceholderSlugKebab*" -and
+            $text -notlike "*$templatePlaceholderSlugUnderscore*"
+        ) { return }
+        $updated = $text.Replace($templatePlaceholderSlugKebab, $Slug)
+        $updated = $updated.Replace($templatePlaceholderSlugUnderscore, $underscoreSlug)
         [System.IO.File]::WriteAllText($_.FullName, $updated)
     }
 }