feat(core,cli): harden install engine and extend skill lint and interview eval

- update only touches the recorded project root; project installs do not
  follow symlinks or junctions; repeated --force rotates .orig backups;
  uninstall never deletes outside the recorded root
- run npm/npx without a shell on Windows and pin optional tool versions
- skip the update check in CI and non-interactive output
- lint: cross-document section pointers, preflight row ids, gate rule
  numbers, per-document size budgets, gate copy equality
- eval: scenarios S19-S21, route and read-cost rejudging, interpretation
  card judging, temp-dir previews and table-form cards no longer fail

build/ci/publish-npm.sh

@@ -11,6 +11,11 @@
 set -euo pipefail
 
 PKG_DIR="${1:-packages/cli}"
+
+# set -e 로 중간에 죽어도 토큰을 담은 임시 npmrc 가 /tmp 에 남지 않게 한다
+npmrc=""
+cleanup() { if [ -n "$npmrc" ]; then rm -f "$npmrc"; fi; }
+trap cleanup EXIT
 cd "$PKG_DIR"
 
 name="$(node -p 'require("./package.json").name')"