docs: make Portainer optional deployment path (#1492)

packages/mosaic/framework/skills/mosaic-portainer/SKILL.md

@@ -1,15 +1,19 @@
 ---
 name: mosaic-portainer
-description: Manage Portainer stacks on the Mosaic infrastructure. Use when asked to list, start, stop, redeploy, or check logs of Docker Swarm stacks via Portainer. Wraps scripts in ~/.config/mosaic/tools/portainer/. Requires load_credentials portainer first.
+description: Manage Docker Swarm stacks through Portainer when a Portainer credential is available. Use when asked to list, start, stop, redeploy, or check logs through Portainer.
 ---
 
 # mosaic-portainer
 
-Manage Portainer stacks via pre-built Mosaic scripts.
+Manage Portainer stacks through supplied scripts.
+
+## Decision Gate
+
+Portainer is optional. Use this skill only when the estate holds a Portainer credential. If a stack README documents `docker stack deploy` on the manager, that is the deploy path. Do not propose Portainer otherwise.
 
 ## Setup
 
-Always load credentials before running scripts:
+After confirming a Portainer credential is available, load it before running scripts:
 
 ```bash
 source ~/.config/mosaic/tools/_lib/credentials.sh
@@ -33,11 +37,11 @@ All scripts live in `~/.config/mosaic/tools/portainer/`.
 
 ## Common Workflows
 
-**Redeploy a stack with fresh images:**
+**Redeploy a stack through Portainer:**
 
 ```bash
 source ~/.config/mosaic/tools/_lib/credentials.sh && load_credentials portainer
-~/.config/mosaic/tools/portainer/stack-redeploy.sh -n mosaic-stack -p
+~/.config/mosaic/tools/portainer/stack-redeploy.sh -n <stack-name> -p
 ```
 
 **Check all stack statuses:**
@@ -51,12 +55,10 @@ source ~/.config/mosaic/tools/_lib/credentials.sh && load_credentials portainer
 
 ```bash
 source ~/.config/mosaic/tools/_lib/credentials.sh && load_credentials portainer
-~/.config/mosaic/tools/portainer/stack-logs.sh -n mosaic-stack -l 100
+~/.config/mosaic/tools/portainer/stack-logs.sh -n <stack-name> -l 100
 ```
 
 ## Notes
 
-- Portainer URL: `https://portainer.example.internal:9443`
-- Primary Docker host: `node-01`, managed via Portainer agent
-- Docker Swarm image updates: `stack-redeploy.sh -p` does NOT guarantee new image pull if digest is pinned; SSH to node and `docker pull` first if needed
-- Credentials: `load_credentials portainer` (framework credentials store)
+- `stack-redeploy.sh -p` does not override a digest-pinned image. Follow the stack README's documented deployment procedure for pinned images.
+- Credentials are loaded through `load_credentials portainer`.