feat(kvb-org-operator): list every command only the operator can run

kvb-org-operator collects the steps that wait on a human across all agents: commands under a deny or unconfirmed ask rule, anything outside the sandbox (keys, permission settings, foreign hosts, root), steps the agent rules reserve for the operator (push, release, tags, reboot) and human-bound ones (hardware key, login, second factor, purchase, decision). Sources are the own session, the kvb-org-rasci register and one message per live peer. Done steps drop out, duplicates merge, the rest is ordered by dependency and printed as a table plus one copyable bash block, then recorded as operator/<slug> register tasks. Agents never run a listed command or hand it to a peer. Operator order 2026-11-03; four descriptions trimmed for the listing budget.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

skills/kvb-check-security/SKILL.md

@@ -1,10 +1,9 @@
 ---
 name: kvb-check-security
 description: >
-  Run the MEDUSA security scanner (medusa-security, PyPI) on a repository,
-  working tree or secret stores. Use for security scans, vetting a repo before
-  cloning, leaked-secret detection in chat or shell history, or /kvb-check-security.
-  Defensive only.
+  Run the MEDUSA scanner (medusa-security) on a repository, working tree or
+  secret stores. Use for security scans, vetting a repo, leaked secrets in
+  chat or shell history, or /kvb-check-security. Defensive only.
 ---
 
 MEDUSA is a defensive AI-first security scanner (40,000+ patterns: CVEs, prompt injection, MCP tool poisoning, leaked secrets).