fix(skills): 禁止自动注入完整技能内容 (#49)

## Summary

- 将 dashscope-image-gen、image-to-image、markdown、tech-diagram、xiaomi-tts
改为仅按需加载，并递增 patch 版本
- 在 Market validator 与 JSON Schema 中禁止 `disable-model-invocation: false`
- 将回归测试接入 `i18n Validate`，同步中英文技能编写规范

## Root cause and impact

这 5 个技能在首次引入时即声明 `disable-model-invocation: false`，导致完整技能正文进入普通请求的
system prompt。修改后市场技能只能声明 `true` 或省略该字段，完整内容仅在显式调用 Skill 工具后加载。

## Validation

- `uv run --quiet scripts/i18n/test_validate_i18n.py`
- `uv run --quiet scripts/i18n/validate-i18n.py`
- `uv run --quiet scripts/i18n/translate.py --check`
- `python3 -m json.tool
scripts/i18n/schema/skill-frontmatter.schema.json`
- `actionlint .github/workflows/i18n-validate.yml`
- `git diff --check`

skills/manage-skills/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   管理 Agent 的技能生命周期：通过 HTTP API 导入、安装、更新、删除技能，
   或通过 AgentFS 文件系统直接编写符合规范的 SKILL.md。Use when 用户要求
   安装技能、从 URL/Git 导入技能、编写新技能、或管理已有技能。
-version: 1.0.5
+version: 1.0.6
 type: meta
 risk_level: low
 status: enabled
@@ -17,7 +17,7 @@ tags:
   - agentfs
 metadata:
   author: desirecore
-  updated_at: '2026-05-05'
+  updated_at: '2026-07-14'
   i18n:
     default_locale: en-US
     source_locale: zh-CN
@@ -38,7 +38,7 @@ metadata:
       description: >-
         Manage the Skill lifecycle of an Agent: import, install, update, and delete Skills via HTTP API, or directly author standards-compliant SKILL.md files via the AgentFS filesystem. Use when the user requests to install Skills, import Skills from URL/Git, author new Skills, or manage existing Skills.
       body: ./SKILL.md
-      source_hash: sha256:eb098cb8c9bdf482
+      source_hash: sha256:57d9f0d8c351f884
       translated_by: human
 market:
   icon: >-
@@ -507,7 +507,7 @@ covering completed items, to-dos, and important decisions.
 | `risk_level`               | Recommended     | enum     | `low` / `medium` / `high`                          |
 | `status`                   | Recommended     | enum     | `enabled` / `disabled`                             |
 | `tags`                     | Optional     | string[] | List of tags, used for search and categorization                           |
-| `disable-model-invocation` | Optional     | boolean  | `false` = opt-in auto-injection of full content into the system prompt; `true` (or omitted) = no auto-injection, only loaded when explicitly invoked via the Skill tool; default `true` |
+| `disable-model-invocation` | Optional     | boolean  | Must be `true` or omitted. Full-content auto-injection is prohibited; skills are loaded only when explicitly invoked via the Skill tool. |
 | `requires`                 | Optional     | object   | Dependency declaration: `tools`, `optional_tools`, `connections` |
 | `metadata`                 | Optional     | object   | Meta information: `author`, `updated_at`                     |
 | `market`                   | Optional     | object   | Market display metadata (only required for Skills published to the Market)             |

skills/manage-skills/SKILL.zh-CN.md

@@ -447,7 +447,7 @@ metadata:
 | `risk_level`               | 推荐     | enum     | `low` / `medium` / `high`                          |
 | `status`                   | 推荐     | enum     | `enabled` / `disabled`                             |
 | `tags`                     | 可选     | string[] | 标签列表，用于搜索和分类                           |
-| `disable-model-invocation` | 可选     | boolean  | `false`=opt-in 自动注入完整内容到 system prompt；`true` 或缺省=不自动注入，仅显式 Skill 工具调用时才加载；默认 `true` |
+| `disable-model-invocation` | 可选     | boolean  | 必须为 `true` 或省略。禁止把技能全文自动注入 system prompt；仅在显式调用 Skill 工具时加载。 |
 | `requires`                 | 可选     | object   | 依赖声明：`tools`、`optional_tools`、`connections` |
 | `metadata`                 | 可选     | object   | 元信息：`author`、`updated_at`                     |
 | `market`                   | 可选     | object   | 市场展示元数据（仅市场发布的技能需要）             |