fix: correct SC citation, copyright years, and harden validator and build script

[84em]

Fixes the five findings from an adversarial review and fact check of the repository.

Changes

• SKILL.md common-mistakes table: the placeholder-as-label row cited 1.3.5 Identify Input Purpose, which governs the autocomplete attribute and is unrelated to labeling. Now cites 3.3.2 Labels or Instructions with a tighter rationale (placeholder vanishes on input).
• SKILL.md frontmatter: description now says six A/AA criteria new in WCAG 2.2. Nine criteria are new in 2.2 overall; three are AAA and out of scope for this skill.
• scripts/validate.mjs: the emdash check covered only SKILL.md while AGENTS.md rule 5 names four authored files. Now checks SKILL.md, README.md, AGENTS.md, and CHANGELOG.md. Negative-tested: an injected emdash in README.md fails validation with the expected message.
• scripts/build-reference.sh: curl now uses --fail (-sSfL) so an upstream 404/500 aborts the script instead of converting the error page and clobbering the committed reference.
• W3C copyright year corrected from 2024 to 2020-2024 in NOTICE, the build script header heredoc, and the committed reference attribution comment, matching the copyright line in the spec itself. The heredoc and the committed header were diffed after the edit and are byte-identical, so the CI drift check stays quiet.

CHANGELOG updated under Unreleased.

Verification

• node scripts/validate.mjs passes (A=31 AA=24 AAA=31 total=86)
• markdownlint-cli 0.45.0 clean with the CI invocation
• bash -n on the build script passes; shellcheck runs in CI (not installed locally)