Harden and publish the Bellwire Skill

[xwchris]

What changed

• make the published Skill self-contained with Direct v2 assets and an Apache 2.0 license
• keep one-time Agent, Ingest, and Wake tokens out of stdout by requiring a new 0600 secret output file
• share protocol validation across the CLI and Direct conformance, including typed Surface validation and uniform 401 checks
• add Skill archive/link, secret handling, and negative validation contract tests
• prepare repository release v0.1.1

Why

The previous release archive referenced files outside the Skill folder, printed one-time tokens to the terminal, and could report Direct Surface conformance without validating the payload consumed by iOS.

Validation

• Skill quick validation
• npm run lint
• npm run typecheck
• npm test: 169 passed
• npm run build
• npm run ios:build
• ClawHub 1.0.1 dry-run: would-publish, 21 files