fix: replace hardcoded ~/.desirecore paths with ${DESIRECORE_ROOT} variable (#16)

## Summary

- 将所有技能文件中的硬编码 `~/.desirecore/` 和 `$HOME/.desirecore/` 路径替换为
`${DESIRECORE_ROOT}/` 变量
- 递增 manifest.json version 至 1.2.1

## Why

dev 模式下 `DESIRECORE_HOME=~/.desirecore-dev`，硬编码路径导致技能读取错误的端口文件和目录。主仓库的
`variable-substitutor.ts` 会在运行时将 `${DESIRECORE_ROOT}` 替换为实际根目录。

## Test plan

- [ ] `npm run dev` 启动后触发任意技能，确认端口路径解析为
`~/.desirecore-dev/agent-service.port`
- [ ] prod 模式确认路径为 `~/.desirecore/agent-service.port`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

skills/_protected-paths.yaml

@@ -71,12 +71,12 @@ protected_paths:
   # ============================================
   # 用户隐私（需用户本人确认）
   # ============================================
-  - path: "~/.desirecore/users/*/privacy.md"
+  - path: "${DESIRECORE_ROOT}/users/*/privacy.md"
     protection: owner_only
     reason: "隐私设置需用户本人或 owner 修改"
     description: "用户隐私边界配置"
 
-  - path: "~/.desirecore/users/*/agents/*/relationship.md"
+  - path: "${DESIRECORE_ROOT}/users/*/agents/*/relationship.md"
     section: "禁区"
     protection: confirm
     reason: "关系禁区需用户确认"