[codex] Add governed pdf skill import

[YuyangXueEd]

Summary

This PR turns anthropics/skills/skills/pdf into a governed Skills Charter package inside Guesswhat-Studio/testSkills.

It demonstrates the Git-backed governance loop:

1. Import a public skill package from anthropics/skills.
2. Preserve provenance in SKILL.md.
3. Optimize the trigger/metadata for team-governed use.
4. Add review evidence under skills/pdf/review-notes/approval.md.
5. Generate skills.json so the approved package exposes install snippets.

Governance Decision

• Package: pdf
• Source: https://github.com/anthropics/skills/tree/main/skills/pdf
• Status: approved
• Owner: @platform
• Evidence: skills/pdf/review-notes/approval.md
• Risk: medium, because the package includes helper scripts and external URLs that require human review

Install After Merge

npx skills add Guesswhat-Studio/testSkills --skill pdf -g -a codex
npx skills add Guesswhat-Studio/testSkills --skill pdf -g -a claude-code
npx skills add Guesswhat-Studio/testSkills --skill pdf -g -a antigravity

skill-creator remains present in skills.json as a candidate package, but only pdf receives install snippets.

Validation

node D:\Workspace\GuesswhatStudio\Skills-as-Docs\packages\cli\dist\index.js scan --root .
node D:\Workspace\GuesswhatStudio\Skills-as-Docs\packages\cli\dist\index.js lint --root . --policy strict --json
node D:\Workspace\GuesswhatStudio\Skills-as-Docs\packages\cli\dist\index.js generate registry --root . --source Guesswhat-Studio/testSkills --install-source Guesswhat-Studio/testSkills --out skills.json --check
node D:\Workspace\GuesswhatStudio\Skills-as-Docs\packages\cli\dist\index.js doctor --root . --source Guesswhat-Studio/testSkills --policy strict

Strict lint and doctor report medium-risk warnings for scripts and external URLs. Those warnings are expected and recorded in the approval evidence; no high-risk blocker was found.