skills: sanitize operator-identity tokens from folded ops skills

Four folded skills carried operator identity tokens that the sanitization
gate (verify-sanitized.sh) forbids in the public framework package:

- kickstart: template path pointed at a private brain checkout; now uses the
  framework-shipped $MOSAIC_HOME/templates/docs/TASKS.md.template
- mosaic-deploy: dropped one estate-specific stack-name row from the example
  table
- mosaic-portainer, mosaic-woodpecker: credentials now name the framework
  credentials store (load_credentials <service>) instead of a private
  checkout path

Estate-specific values can live in a skills-local override, which the linker
applies with precedence over canonical skills.

packages/mosaic/framework/skills/kickstart/SKILL.md

@@ -166,13 +166,13 @@ Always load these orchestrator-relevant skills:
 Create tracking files using templates:
 
 ```bash
-TEMPLATES=~/src/jarvis-brain/docs/templates
+MOSAIC_HOME="${MOSAIC_HOME:-$HOME/.config/mosaic}"
 
-# Create tasks.md scaffold
-envsubst < $TEMPLATES/orchestrator/tasks.md.template > docs/tasks.md
+# Create tasks.md scaffold from the framework-shipped template
+cp "$MOSAIC_HOME/templates/docs/TASKS.md.template" docs/tasks.md
 
-# Create learnings tracking
-envsubst < $TEMPLATES/orchestrator/orchestrator-learnings.json.template > docs/orchestrator-learnings.json
+# Create learnings tracking (scaffold — adapt to your estate's template)
+echo '{}' > docs/orchestrator-learnings.json
 ```
 
 Then populate `docs/tasks.md` with tasks derived from the issues:

packages/mosaic/framework/skills/mosaic-deploy/SKILL.md

@@ -69,7 +69,6 @@ Check deployment:
 | mosaic-stack | `mosaic-stack` |
 | sage-phr | `sage-phr` |
 | openbrain | `openbrain` |
-| jarvis-crypto | `jarvis-crypto` |
 | firefly | `firefly` |
 
 ## Notes

packages/mosaic/framework/skills/mosaic-portainer/SKILL.md

@@ -56,4 +56,4 @@ source ~/.config/mosaic/tools/_lib/credentials.sh && load_credentials portainer
 - Portainer URL: `https://10.1.1.43:9443`
 - Primary Docker host: `w-docker0` (10.1.1.45) managed via Portainer agent
 - Docker Swarm image updates: `stack-redeploy.sh -p` does NOT guarantee new image pull if digest is pinned; SSH to node and `docker pull` first if needed
-- Credentials source: `~/src/jarvis-brain/credentials.json` (must be cloned)
+- Credentials: `load_credentials portainer` (framework credentials store)

packages/mosaic/framework/skills/mosaic-woodpecker/SKILL.md

@@ -65,6 +65,6 @@ cd ~/src/<repo>
 ## Notes
 
 - CI URL: `https://ci.mosaicstack.dev`
-- Credentials: `load_credentials woodpecker` (from `~/src/jarvis-brain/credentials.json`)
+- Credentials: `load_credentials woodpecker` (framework credentials store)
 - `ci-queue-wait.sh` is automatically called by `pr-merge.sh` unless `--skip-queue-guard` is passed
 - Pipeline output shows step-level status: OK / FAIL / RUN / SKIP / WAIT