fix(skills): track orphaned file_write.py + sync FEATURES.md count 74→75

[AVADSA25]

Summary

• Tracks skills/file_write.py — existed in the working tree but was never committed (orphaned since Apr 17). The file is a real, working skill (259 lines, full metadata, SkillRegistry loads it, tests in test_agent_runner.py already reference it as a grantable skill).
• Bumps FEATURES.md skill count from 74 → 75 in the three numerical references that previously said 74, plus the System Control category row count (10) → (11) (file_write was already listed in that row, just uncounted).

Context

Discovered during a parent numerical-truth audit between README.md and FEATURES.md: git ls-files skills/*.py | grep -v __init__ | wc -l returned 74 while ls skills/*.py returned 75. The orphan was skills/file_write.py.

The skill is purpose-built for remote callers over HTTP MCP, with stronger safety than the built-in agent tool of the same name in codec_agents.py:

• Blocks system roots (/System, /etc, /usr, /Library, /var, /private, /dev, /Volumes)
• Blocks credential filename patterns (.ssh, .env, id_rsa, keychain, api_key, etc.)
• Blocks executable extensions (.pem, .key, .p12)
• Resolves symlinks via realpath (defeats symlink traversal)
• 500 KB per-call cap
• Audits every successful write to ~/.codec/file_write.log (JSON-lines)

SkillRegistry.scan() discovers it correctly; SKILL_MCP_EXPOSE=True makes it available over MCP. Same skill name as the built-in agent tool but the runtime resolution paths are independent (built-in tool used inside crews, skill used over MCP / chat / voice dispatch).

Out of scope

• FEATURES.md line 3 header still says "73 skills" — left untouched per the parent audit's domain.
• Section 6 header still says "78 features" even though 75 skills + 4 infrastructure = 79 — same reasoning, parent audit reconciles all section / total counts holistically.
• README.md untouched.

Test plan

• git ls-files skills/*.py | grep -v __init__ | wc -l → 75 (matches filesystem)
• SkillRegistry loads file_write with metadata (verified locally: name, description, 11 triggers, MCP_EXPOSE=True)
• No imports of skills.file_write from elsewhere (only string references via skill name)
• CI passes
• Spot-check FEATURES.md renders correctly on GitHub

🤖 Generated with Claude Code

[AVADSA25]

Rebased onto main and resolved the FEATURES.md conflict. Bumped totals to keep both docs aligned now that file_write.py is tracked:

• 368 features (was 367 — Section 6 went 78 → 79 to match arithmetic 75 skills + 4 infra)
• 75 skills (74 → 75 across line 3 header, Section 6 header, sub-header, summary block, all README badges + body refs)
• 940+ tests / 58K+ LOC unchanged (already correct on main from PR docs: sync README + FEATURES.md to one source of truth #36)

Both files now agree on a single fact set. Merge should be clean.