fix: APM skill.ts — YAML escaping, type safety, and test coverage #924

Follow-up from PR #876 post-merge review

Reviewer: River (TypeScript Architect) via @diberry
Original PR: #876

Critical

1. No YAML value escaping — skill names/descriptions containing colons, hashes, quotes, or newlines produce invalid YAML in publish() and generateApmYml()
2. Hand-rolled YAML parser in installFromGitHub — line-splitting and regex will break on multi-line strings, quoted values with colons. Consider yaml npm package (0 deps, 50KB).

Medium

3. catch (err: any) x2 should be catch (err: unknown) with narrowing (skill.ts:1057, 1171)
4. as { name: string; path: string } x3 should use type guards (skill.ts:1117, 1125, 1131)
5. Non-null assertions (!) x6 — regex groups and array indices not narrowed by TS
6. parseFrontMatter returns Record<string, string> — no compile-time contract (skill.ts:819)
7. ApmManifest declared but never validated at runtime

Low

8. generateApmYml uses sync fs (writeFileSync) while skill.ts is fully async
9. Silent error swallowing in collectSkills, readProjectName, listSkills
10. 568 lines in one file — needs splitting

Action Items (priority order)

1. Add YAML value escaping for all publish/init output paths
2. Add unit tests for YAML parsing — at least 5 cases
3. Replace catch (err: any) with catch (err: unknown)
4. Add parseApmManifest() runtime validator
5. Consider yaml npm package vs maintaining regex parser

Also noted by @Omzig

• .copilot/skills/ is not supported by GitHub Copilot CLI (only github.com). VS Code enhancement request (Normalize Github Copilot File Locations microsoft/vscode#308091) was closed.