fix: prevent XML injection in skills-ref to-prompt output

[pproenca]

Motivation

• to-prompt emitted raw SKILL.md body inside a <![CDATA[ ... ]]> block, allowing a crafted ]]> in SKILL.md to break out of CDATA and inject XML nodes.
• The intent is to neutralize the CDATA terminator in skill content while preserving emitted content and behavior.

Description

• In scripts/skills-ref the SKILL.md body is now sanitized by splitting CDATA terminators: ]]> → ]]]]><![CDATA[> and the script emits the safeCdata value instead of the raw body.
• Added a regression fixture tests/fixtures/cdata-terminator/SKILL.md containing an example CDATA-terminator payload.
• Extended tests/run-tests.sh with test_to_prompt_cdata_safety which runs skills-ref to-prompt on the fixture and fails if injected XML appears outside the CDATA block.

Testing

• Ran ./tests/run-tests.sh and all tests passed (All tests passed: 7/7).
• Manually ran ./scripts/skills-ref to-prompt tests/fixtures/cdata-terminator to verify the CDATA terminator is split and no injected XML appears outside CDATA.

---

Codex Task