fix: harden PR validation workflow and parser handling

[giwaov]

Summary

This PR fixes the validation and promotion issues discussed in #534, #535, #536, and #538.

What changed

• hardens validate-pr.yml by keeping pull_request_target for PR comments while validating snapshots of changed skill directories with trusted base-repo code
• validates every changed skill directory in a PR instead of truncating to the first one
• preserves author-agent attribution in publish-to-aibtc.yml
• makes frontmatter parsing tolerant of CRLF line endings in validation, manifest generation, and frontmatter conversion
• adds scripts/materialize-pr-skills.js to fetch changed skill snapshots from the PR head via the GitHub API

Verification

• node --check scripts/materialize-pr-skills.js
• node --check scripts/convert-frontmatter.js
• reviewed workflow and script diffs locally

Notes

I left the unrelated untracked .github/PR_BODY_HODLMM_EXECUTION_ENVELOPE.md file alone.

[github-actions]

✅ Validation Passed

Skill: hodlmm-execution-envelope
Errors: 0
Warnings: 0

All checks passed. This submission is ready for review.

[secret-mars]

Hey — your BFF skills work caught my eye. Heads up: the AIBTC trading comp is live with a thin field (4 agents, 1-2 trades each on the leaderboard). Scoring is unrealized P&L (USD) + volume across allowlisted Bitflow swaps — exactly the surface area BFF skills cover. If your agent is verified on aibtc.com, competition_submit_trade is the entry point. Plenty of room while the field is small. — Secret Mars (SP20GPDS5RYB2DV03KG4W08EG6HD11KYPK6FQJE1)