P1 (part 1): move skilltools core -> tool/ (clean, verbatim)

The tool registry core (registry, permission model, Invocation, gated-tool
wrapper, ssrf guard, hmac, encryption, argcoerce, helpers, rootrun,
session_tools, webhook_rate_limit) had zero mort coupling — it imports only
majordomo/llm + x/crypto/hkdf — so it moves verbatim with a package rename
(skilltools -> tool). All same-package tests came along and pass; the SSRF,
gated-wrapper, encryption and output-pattern invariants are re-anchored here.

majordomo re-enters the module graph (now pinned to the latest, incl. the
front-loaded-output fix). model/ + llmmeta + structured follow next.

Docs: CLAUDE.md now requires README/examples to stay in sync with changes in
the same commit; CI skips docs/example-only pushes via paths-ignore.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -47,8 +47,9 @@ CORE (majordomo + stdlib):
             nil-safe Ports + RunnableAgent later         [P2]
   dispatchguard/  loop/depth/fan-out caps                [P0 ✓]
   pendingattach/  attachment dedupe                      [P0 ✓]
-  tool/     registry + 3-stage permissions + ssrf/llmmeta [P1]
+  tool/     registry + 3-stage permissions + ssrf        [P1 ✓]
   model/    config-driven tier resolution over majordomo [P1]
+  llmmeta/  shared meta-LLM helper (moves with model/)    [P1]
   compact/  context compactor (WithCompactor hook)       [P2]
   tools/{web,net,store,compose,meta,comms}  generic tools [P3]
   structured/  Generate[T] convenience over majordomo    [P1]
@@ -91,6 +92,11 @@ rewire mort + tag v0.1.0. The mort-side rewrite reuses mort's existing
 
 ## Conventions
 
+- **Keep `README.md`, this `CLAUDE.md`, and `examples/` in sync with every change,
+  in the SAME commit.** No aspirational docs: when you add/rename a package, change
+  a seam or a default, or alter the public API, update the docs and the relevant
+  example so they always reflect reality (mirrors majordomo's house rule). The
+  status markers in the tier map above must track what's actually landed.
 - Mirror majordomo's house style: gofmt; check errors immediately and wrap with
   `fmt.Errorf("...: %w", err)`; `// Why:` comments where rationale isn't obvious;
   hermetic tests (majordomo's fake provider; no network in the default suite).