docs: make skills and instructions action-first

[Zacaria]

Summary

• Rewrite 46 Markdown files: the three skills, README/INSTALL, onboarding, operating guides, references and maintainer instructions, including AGENTS.md.
• Lead with commands and short numbered steps. Put warnings beside the affected action; remove repeated explanations.
• Remove 4,614 words (23.3% overall). The investigation skill is about 50% shorter; the Node runtime skill about 54% shorter.
• Correct stale handoff commands to the actual CLI and README-verification helper. Runtime, tests, package/lock, scripts and plugin manifests are unchanged.

Release Title

• Conventional Commit title: docs: make skills and instructions action-first

Testing

• npm run verify: 371 tests across 44 files; types, lint, format, build, packaged-plugin handshake, release contract and packlist passed.
• npm run docs:build and git diff --check passed.
• Independent review: all 45/45 diffs PASS; reviewed tree 3e5d62f991300dfe36065066e53e184d11f40c5c. Safety and supported contracts preserved; 50 concrete Bash snippets syntax-checked.
• Approved follow-up changes only AGENTS.md; the 45 reviewed files are unchanged. Full local verification rerun after this edit. Final tree: 508c57cc2d4c49e2da2adefc24e27fd0e8539804.

Notes

• Docs updated; no runtime behavior change.
• No secrets or environment-specific configuration added.
• The owner requested the protected-file approval again and the AGENTS.md edit succeeded through that flow. The file is now shorter and records the action-first writing rule; existing setup and CLI rules remain intact. No approval blocker remains.
• No real Kibana, native credential-store, or native client registration checks. No merge, release or deployment performed.