fix: replace hardcoded ~/.desirecore paths with ${DESIRECORE_ROOT} variable (#16)

## Summary

- 将所有技能文件中的硬编码 `~/.desirecore/` 和 `$HOME/.desirecore/` 路径替换为
`${DESIRECORE_ROOT}/` 变量
- 递增 manifest.json version 至 1.2.1

## Why

dev 模式下 `DESIRECORE_HOME=~/.desirecore-dev`，硬编码路径导致技能读取错误的端口文件和目录。主仓库的
`variable-substitutor.ts` 会在运行时将 `${DESIRECORE_ROOT}` 替换为实际根目录。

## Test plan

- [ ] `npm run dev` 启动后触发任意技能，确认端口路径解析为
`~/.desirecore-dev/agent-service.port`
- [ ] prod 模式确认路径为 `~/.desirecore/agent-service.port`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

skills/web-access/SKILL.md

@@ -156,14 +156,14 @@ Launch a dedicated Chrome instance with remote debugging enabled:
 ```bash
 /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome \
   --remote-debugging-port=9222 \
-  --user-data-dir="$HOME/.desirecore/chrome-profile"
+  --user-data-dir="${DESIRECORE_ROOT}/chrome-profile"
 ```
 
 **Linux**:
 ```bash
 google-chrome \
   --remote-debugging-port=9222 \
-  --user-data-dir="$HOME/.desirecore/chrome-profile"
+  --user-data-dir="${DESIRECORE_ROOT}/chrome-profile"
 ```
 
 **Windows (PowerShell)**:
@@ -359,7 +359,7 @@ See [references/cdp-browser.md](references/cdp-browser.md) for:
 | `BrowserNavigate({ target, url })` | Navigate an existing tab |
 | `BrowserEval({ target, expression })` | Run JS in the tab to extract structured data |
 | `BrowserClick({ target, selector, mode: 'real-mouse' })` | Real-mouse mode for anti-bot-strict sites |
-| `BrowserScreenshot({ target })` | Saved under ~/.desirecore/screenshots/ |
+| `BrowserScreenshot({ target })` | Saved under ${DESIRECORE_ROOT}/screenshots/ |
 | `BrowserScroll({ target, direction: 'bottom' })` | Trigger lazy loading |
 | `BrowserSetFiles({ target, selector, files })` | Upload local files (**user confirmation required**) |
 | `BrowserCloseTab({ target })` | Clean up temporary tabs at task end |

skills/web-access/SKILL.zh-CN.md

@@ -70,14 +70,14 @@ Launch a dedicated Chrome instance with remote debugging enabled:
 ```bash
 /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome \
   --remote-debugging-port=9222 \
-  --user-data-dir="$HOME/.desirecore/chrome-profile"
+  --user-data-dir="${DESIRECORE_ROOT}/chrome-profile"
 ```
 
 **Linux**:
 ```bash
 google-chrome \
   --remote-debugging-port=9222 \
-  --user-data-dir="$HOME/.desirecore/chrome-profile"
+  --user-data-dir="${DESIRECORE_ROOT}/chrome-profile"
 ```
 
 **Windows (PowerShell)**:
@@ -273,7 +273,7 @@ See [references/cdp-browser.md](references/cdp-browser.md) for:
 | `BrowserNavigate({ target, url })` | 在指定 tab 跳转 |
 | `BrowserEval({ target, expression })` | 在 tab 内跑 JS，提取结构化数据 |
 | `BrowserClick({ target, selector, mode: 'real-mouse' })` | 反爬严格站点用真实鼠标事件 |
-| `BrowserScreenshot({ target })` | 写入 ~/.desirecore/screenshots/ |
+| `BrowserScreenshot({ target })` | 写入 ${DESIRECORE_ROOT}/screenshots/ |
 | `BrowserScroll({ target, direction: 'bottom' })` | 触发懒加载 |
 | `BrowserSetFiles({ target, selector, files })` | 上传本地文件（**需用户确认**） |
 | `BrowserCloseTab({ target })` | 任务收尾清理临时 tab |

skills/web-access/references/browser-tools.md

@@ -76,7 +76,7 @@ BrowserClick:
 ```yaml
 BrowserScreenshot:
   target: <targetId>
-  filename: 自定义文件名.png  # 可选；写入 ~/.desirecore/screenshots/
+  filename: 自定义文件名.png  # 可选；写入 ${DESIRECORE_ROOT}/screenshots/
 ```
 
 ### BrowserScroll

skills/web-access/references/cdp-browser.md

@@ -280,7 +280,7 @@ print(clean_md)
 
 Chrome is not running with remote debugging. Tell the user:
 > "请先用下面的命令启动 Chrome：
-> `/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --remote-debugging-port=9222 --user-data-dir=\"$HOME/.desirecore/chrome-profile\"`
+> `/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --remote-debugging-port=9222 --user-data-dir=\"${DESIRECORE_ROOT}/chrome-profile\"`
 > 然后手动登录需要抓取的网站，再让我继续。"
 
 ### `browser.contexts[0]` is empty
@@ -316,7 +316,7 @@ The selector is stale — the site updated its DOM. Dump `page.content()[:5000]`
 - **Never log or print cookies** from `context.cookies()` even during debugging
 - **Never extract and store** the user's session tokens to files
 - **Never use the CDP session** to perform writes (post, comment, like) unless the user explicitly requested it
-- The `~/.desirecore/chrome-profile` directory contains the user's credentials — treat it as sensitive
+- The `${DESIRECORE_ROOT}/chrome-profile` directory contains the user's credentials — treat it as sensitive
 - If the user asks to "log in automatically", refuse and explain they must log in manually in the Chrome window; the skill only reads already-authenticated sessions
 
 ---