fix: replace hardcoded ~/.desirecore paths with ${DESIRECORE_ROOT} variable (#16)

## Summary

- 将所有技能文件中的硬编码 `~/.desirecore/` 和 `$HOME/.desirecore/` 路径替换为
`${DESIRECORE_ROOT}/` 变量
- 递增 manifest.json version 至 1.2.1

## Why

dev 模式下 `DESIRECORE_HOME=~/.desirecore-dev`，硬编码路径导致技能读取错误的端口文件和目录。主仓库的
`variable-substitutor.ts` 会在运行时将 `${DESIRECORE_ROOT}` 替换为实际根目录。

## Test plan

- [ ] `npm run dev` 启动后触发任意技能，确认端口路径解析为
`~/.desirecore-dev/agent-service.port`
- [ ] prod 模式确认路径为 `~/.desirecore/agent-service.port`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

skills/web-access/references/browser-tools.md

@@ -76,7 +76,7 @@ BrowserClick:
 ```yaml
 BrowserScreenshot:
   target: <targetId>
-  filename: 自定义文件名.png  # 可选；写入 ~/.desirecore/screenshots/
+  filename: 自定义文件名.png  # 可选；写入 ${DESIRECORE_ROOT}/screenshots/
 ```
 
 ### BrowserScroll

skills/web-access/references/cdp-browser.md

@@ -280,7 +280,7 @@ print(clean_md)
 
 Chrome is not running with remote debugging. Tell the user:
 > "请先用下面的命令启动 Chrome：
-> `/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --remote-debugging-port=9222 --user-data-dir=\"$HOME/.desirecore/chrome-profile\"`
+> `/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --remote-debugging-port=9222 --user-data-dir=\"${DESIRECORE_ROOT}/chrome-profile\"`
 > 然后手动登录需要抓取的网站，再让我继续。"
 
 ### `browser.contexts[0]` is empty
@@ -316,7 +316,7 @@ The selector is stale — the site updated its DOM. Dump `page.content()[:5000]`
 - **Never log or print cookies** from `context.cookies()` even during debugging
 - **Never extract and store** the user's session tokens to files
 - **Never use the CDP session** to perform writes (post, comment, like) unless the user explicitly requested it
-- The `~/.desirecore/chrome-profile` directory contains the user's credentials — treat it as sensitive
+- The `${DESIRECORE_ROOT}/chrome-profile` directory contains the user's credentials — treat it as sensitive
 - If the user asks to "log in automatically", refuse and explain they must log in manually in the Chrome window; the skill only reads already-authenticated sessions
 
 ---