skills: sanitize operator-identity tokens from folded ops skills

Four folded skills carried operator identity tokens that the sanitization
gate (verify-sanitized.sh) forbids in the public framework package:

- kickstart: template path pointed at a private brain checkout; now uses the
  framework-shipped $MOSAIC_HOME/templates/docs/TASKS.md.template
- mosaic-deploy: dropped one estate-specific stack-name row from the example
  table
- mosaic-portainer, mosaic-woodpecker: credentials now name the framework
  credentials store (load_credentials <service>) instead of a private
  checkout path

Estate-specific values can live in a skills-local override, which the linker
applies with precedence over canonical skills.

packages/mosaic/framework/skills/mosaic-portainer/SKILL.md

@@ -56,4 +56,4 @@ source ~/.config/mosaic/tools/_lib/credentials.sh && load_credentials portainer
 - Portainer URL: `https://10.1.1.43:9443`
 - Primary Docker host: `w-docker0` (10.1.1.45) managed via Portainer agent
 - Docker Swarm image updates: `stack-redeploy.sh -p` does NOT guarantee new image pull if digest is pinned; SSH to node and `docker pull` first if needed
-- Credentials source: `~/src/jarvis-brain/credentials.json` (must be cloned)
+- Credentials: `load_credentials portainer` (framework credentials store)