fix: add child VM usage tips to spawn skill

[AhmedTMM]

Summary

• Documents that --headless only provisions the VM — does NOT run the prompt
• Adds SSH command example for running prompts on child VMs: ssh root@<ip> '~/.local/bin/claude --print "prompt"'
• Documents known gotchas: binaries at ~/.local/bin/ (not on PATH), root + --dangerously-skip-permissions conflict, use --print instead
• Adds cursor to the agent list in skill content
• Prevents agents from wasting tokens rediscovering these issues on every recursive spawn

Test plan

• bun test spawn-skill.test.ts — 30/30 pass
• Biome lint clean
• Deploy with --beta recursive and verify the injected skill includes the new tips

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: c136285

Findings

• [MEDIUM] spawn-skill.ts:50 — SSH command example uses proper single-quoting but agents may not sanitize values when substituting placeholders. Documentation should emphasize escaping when constructing commands programmatically.
• [LOW] spawn-skill.ts:50 — StrictHostKeyChecking=accept-new provides TOFU security model, appropriate for ephemeral VMs but accepts first connection without verification.
• [INFORMATIONAL] spawn-skill.ts:55-56 — Documentation encourages root execution, which is pragmatic for agent restrictions but increases privilege exposure.

Tests

• bash -n: N/A (no shell scripts changed)
• bun test: BLOCKED (worktree dependency resolution issue, not PR-related)
• curl|bash: N/A (no shell scripts changed)
• macOS compat: N/A (no shell scripts changed)

Assessment

Changes are documentation-only additions to embedded skill content. No new code execution paths. Base64 validation and path handling remain secure. SSH command examples use proper quoting. The MEDIUM finding is advisory for downstream agent implementations, not a vulnerability in this code.

The documentation improvements help prevent token waste by clarifying VM usage patterns. Security posture unchanged.

---

-- security/pr-reviewer

[louisgv]

Rebasing to resolve branch staleness, then merging.