Ship built-in operator skills, seeded on API startup

Seven skills now travel with Handler itself and are seeded into the
managed skill store when the API boots: gate recovery, the test
authorship standard, checkpoint quality, memory discipline, mise-task
rules, scheduled-run continuity, and secrets hygiene. They cover the
judgment layer the hard gates cannot enforce — the gates check that
tests pass, not that an agent responded to a blocked gate sensibly or
kept credentials out of logs.

Seeding is idempotent by name: existing rows are never touched, so
operator edits and enable/disable choices survive every upgrade;
deleting a built-in restores it as shipped on the next start (disable
is the supported off-switch). Rows are created shared and enabled, so
they sync to every worker like any managed skill and remain
admin-editable from the dashboard or the mobile app. Seeding failures
log and never block the API from serving.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01731mKtVzsfeT4Vi3TvkR48

CHANGELOG.md

@@ -36,6 +36,29 @@ since its last release:
   sign out with server-side revocation) and Manage gains the admin Users screen
   (invite with shareable links, promote/disable, reset links, delete).
 
+### Added — built-in operator skills, pre-installed on every deployment
+
+Seven skills now ship inside Handler (`handler.builtin_skills`) and are seeded into
+the managed skill store on API startup, so every fresh install — and every existing
+deployment on upgrade — starts with the judgment layer the hard gates can't enforce:
+
+- `handler-gate-recovery` — respond to a blocked completion/push gate by fixing the
+  real failure; never delete/skip tests, weaken the mise `test` task, or `--no-verify`.
+- `handler-testing` — every behavior change lands with a test that fails without it;
+  keep suites fast and deterministic.
+- `handler-checkpoints` — checkpoints written for a phone-sized glance; questions only
+  for operator-only decisions, with a recommended default.
+- `handler-memory` — search before starting; save gotchas/decisions/runbooks, not
+  narration or secrets.
+- `handler-mise-tasks` — `mise run test` is the verification contract; never narrow it
+  to get green.
+- `handler-scheduled-runs` — the read-state-file → one increment → overwrite-state-file
+  continuity pattern for recurring runs.
+- `handler-secrets` — injected credentials stay out of logs, commits, PRs, and memory.
+
+Seeding is idempotent by name: operator edits/disables survive every upgrade; deleting
+a built-in restores it (as shipped) on the next API start. 6 new tests (406 total).
+
 ### Added — user accounts: email sign-in, invites, resets, per-user separation
 
 - **Email + password accounts** replace "know the API key" for humans. First run shows