feat(core,cli): harden install engine and extend skill lint and interview eval

- update only touches the recorded project root; project installs do not
  follow symlinks or junctions; repeated --force rotates .orig backups;
  uninstall never deletes outside the recorded root
- run npm/npx without a shell on Windows and pin optional tool versions
- skip the update check in CI and non-interactive output
- lint: cross-document section pointers, preflight row ids, gate rule
  numbers, per-document size budgets, gate copy equality
- eval: scenarios S19-S21, route and read-cost rejudging, interpretation
  card judging, temp-dir previews and table-form cards no longer fail

build/eval/interview/fixtures/s14-non-design-bug/form.js

@@ -0,0 +1,9 @@
+// 이메일 검증 — 정규식의 앵커가 잘못돼 올바른 주소도 항상 실패한다.
+const EMAIL_RE = /^[^@\s]+@[^@\s]+\.[^@\s]+$x/;
+
+document.getElementById("subscribe").addEventListener("submit", (event) => {
+  const value = document.getElementById("email").value.trim();
+  const ok = EMAIL_RE.test(value);
+  document.getElementById("error").hidden = ok;
+  if (!ok) event.preventDefault();
+});