docs: Skill Market — verified line-by-line audit with code references

Every finding verified by reading actual code (skill_loader.py 283 lines,
seed_skills_final.py 101 lines). Each finding has: file, line number,
code excerpt, reproduction steps.

CRITICAL #1: get_tenant_roles() reads SSM /tenants/{id}/roles — NO CODE
writes this parameter. Always returns ["employee"]. Verified by searching
entire codebase for SSM put_parameter matching this path.

CRITICAL #2: 20 department skills use allowedRoles like ["sales","engineering"]
but tenant_roles = ["employee"] always. "employee" not in any department
skill's allowedRoles. Only 6 global skills work.

HIGH #3-#6: Verified manifest=None→True (line 64), env var collision
(line 211 appends without dedup), S3 sync try/except (line 103-105),
global API keys (line 205-211).

Chinese content matches English in depth and structure.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: JiaDe