docs(verify): CSO fix, Ctrl+F mental model, sandbox extraction

[bensonwong]

Summary

• CSO description fix: rewrote the skill description field to be trigger-surface only (removes workflow content that violated the CSO "no workflow in description" rule); now lists semantic triggers like OCR, evidence, citations, source validation
• Ctrl+F mental model for sourceMatch: replaced the ≤4-word counting heuristic with a "What would I Ctrl+F?" framing + a fact-type quick-reference table (dollar amounts, time limits, party names, priority tiers, trigger verbs, tax thresholds); root cause was models choosing the wrong thing to count, not miscounting
• Sandbox extraction: moved the 25-line cloud sandbox constraint block to cloud-sandbox-constraints.md and replaced the inline section with a one-line reference — keeps SKILL.md focused on the workflow
• Auth recovery simplification: collapsed the 15-line auth block to one sentence pointing to CLI-printed recovery options; removed hardcoded script -q -c command (CLI now emits Option A/B itself)
• Parallel generation block: condensed 400-word sub-agent bullet into structured sub-bullets with Format 1 / Format 2 clearly separated
• STOP AND CHECK gate: added a pre-verify checklist before Step 3 to catch common citation mismatches before running the CLI
• Misc fixes: mkdir -p removed (CLI auto-creates dir), p field corrected ("1_0" → "page_number_1_index_0"), dangling "triage row above" reference made explicit

Test plan

• Load the verify skill and confirm the description triggers on semantic phrases (OCR, verify claims, cite sources, find evidence) without naming the workflow
• Run a verify session in a cloud sandbox ($CLAUDE_CODE_REMOTE=true) and confirm the agent reads cloud-sandbox-constraints.md before invoking deepcitation
• Verify a doc with Format 2 citations and confirm p field uses page_number_N_index_I format (not N_I)
• Confirm auth recovery no longer hardcodes the script command — agent should follow CLI-printed options
• Confirm the STOP AND CHECK gate appears in agent output before verify is invoked