fix: document known agentskill.sh scanner false positives

[indigokarasu]

Documents 3 known false positive patterns in the agentskill.sh security scanner:

1. Sensitive File Access — ~/.hermes/ paths flagged as 'Access to home directory dotfiles' — these are Hermes's own operational directories
2. Data Exfiltration — api.github.com curl calls flagged — GitHub's own public API for release metadata
3. Social Engineering — 'Auto-approved' in command descriptions flagged — operational documentation, not urgency manipulation

Each includes explanation and scanner-safe rephrasing guidance.