v1.1.0 — 27 skills, downstream publish pipeline

Since v1.0.0 (24 skills): three new skills, a one-way publish pipeline for
redistributing a de-branded copy downstream, and a user-facing section on the
risks of installing agent skills.

New skills

• srx-syslog-logging — external syslog/SIEM delivery, the RE vs PFE logging
  split, and why a non-default syslog port can be discarded silently
• srx-chassis-cluster-proxmox — chassis cluster whose nodes are Proxmox guests
• clearpass-proxmox-deploy (draft) — HPE Aruba ClearPass 6.14 on Proxmox VE

25 of 27 reviewed. clearpass-proxmox-deploy ships as a draft and
srx-syslog-logging has not yet been through the two-stage review.

Publish pipeline

scripts/publish-jnpr.py exports a de-branded copy to a downstream org with no
shared git history, so branding cannot travel downstream and downstream copyright
cannot travel back. The de-branding is verified, not assumed — the run fails
closed if any forbidden token, unpublished-docs link, or doc-dependent script
survives into the export.

Attribution is scoped deliberately: nested metadata.sources[].author entries
keep crediting the original lab work while the package author is rewritten.

Before You Install

New README section covering risks that had no user-facing mention: a skill is
instructions your agent follows (read the whole directory — the deployment skills
ship Python helpers), and a pasted config is untrusted input that can carry
prompt injection. Also covers secret disclosure to model providers, and frames
skill selection around discovery quality rather than token cost.

CI

Secret scanning moved from gitleaks-action to a version-pinned,
checksum-verified gitleaks binary. The Action requires a paid licence for
organization repos and fails closed without one — a red check that means
"unlicensed" is indistinguishable from one that means "leak found".