feat(core,cli): harden install engine and extend skill lint and interview eval

- update only touches the recorded project root; project installs do not
  follow symlinks or junctions; repeated --force rotates .orig backups;
  uninstall never deletes outside the recorded root
- run npm/npx without a shell on Windows and pin optional tool versions
- skip the update check in CI and non-interactive output
- lint: cross-document section pointers, preflight row ids, gate rule
  numbers, per-document size budgets, gate copy equality
- eval: scenarios S19-S21, route and read-cost rejudging, interpretation
  card judging, temp-dir previews and table-form cards no longer fail

.forgejo/workflows/ci.yml

@@ -15,12 +15,17 @@ jobs:
       - name: checkout
         env: { CI_TOKEN: "${{ github.token }}" }
         run: |
-          proto="${GITHUB_SERVER_URL%%://*}"; host="${GITHUB_SERVER_URL#*://}"
-          url="$proto://actions:${CI_TOKEN}@${host%/}/${GITHUB_REPOSITORY}.git"
+          # 토큰을 remote URL 에 넣지 않는다 — URL 은 .git/config 에 남고(host 모드라 다음 잡까지
+          # 워크스페이스가 남는다) fetch 명령행에도 보인다. 인증 헤더는 이 fetch 한 번에만 환경변수로 준다
+          # (GIT_CONFIG_COUNT, git 2.31+). 예전 실행이 남긴 토큰 URL remote 는 지우고 새로 만든다.
           [ -d .git ] || git init -q .
           git remote remove origin 2>/dev/null || true
-          git remote add origin "$url"
-          git fetch -q --depth 1 origin "$GITHUB_REF"
+          git remote add origin "${GITHUB_SERVER_URL%/}/${GITHUB_REPOSITORY}.git"
+          auth="$(printf 'actions:%s' "$CI_TOKEN" | base64 | tr -d '\n')"
+          GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraheader \
+            GIT_CONFIG_VALUE_0="Authorization: Basic $auth" \
+            git fetch -q --depth 1 origin "$GITHUB_REF"
+          unset auth
           git checkout -q -f FETCH_HEAD
           git clean -qfdx