v6.2.7 Bind skill evidence and inject active skills

Fixes candidate-bound verified skill feedback, active skill injection through agent/pre-step, and documentation for the package.json dsh.bundle.patch plus cordis.patch.yml contract. Validation: 7 tests passed; npm audit reports 0 vulnerabilities.