Say what skills/ actually registers, and what update-chattolib.skill is for

The directory scan in _register_bundled_skills requires skills/<name>/SKILL.md,
and it is the only door — Hermes has no separate loader for .skill files in a
plugin directory. So skills/update-chattolib.skill, which sits flat in skills/,
has never been registered and cannot be, which reads as a bug to anyone who
counts the files.

It is not one: it is a local development convenience for refreshing the vendored
tree, and the refresh it wraps is already specified by vendor_chattolib.sh and
VENDORING.md, which is where the knowledge belongs. Recorded here so the missing
registration is not "fixed" by moving the file, and so the question behind that
move — whether a vendoring workflow belongs in a skill shipped to every installer
— gets decided rather than assumed.

Verified by registering our two directories and nothing else:
chatto-platform-plugin and chatto-plugin-update.

AGENTS.md

@@ -49,6 +49,23 @@ either update the upstream library and re-run the refresh, or apply the
 fix in the adapter code (not in `vendor/`). The dead-field sweep command
 excludes `vendor/` for this reason.
 
+### skills/ holds two different things
+
+**`_register_bundled_skills` registers `skills/<name>/SKILL.md` and nothing
+else** — it requires a directory containing a `SKILL.md`, and it is the only
+door: Hermes has no separate loader for `.skill` files in a plugin directory.
+Verified: registering our two directories yields exactly
+`chatto-platform-plugin` and `chatto-plugin-update`.
+
+`skills/update-chattolib.skill` is therefore **not a bundled skill and never
+reaches an agent** — it is a local development convenience for refreshing the
+vendored tree, written as a script because the refresh is mechanical. The
+instructions it wraps are `vendor_chattolib.sh` and VENDORING.md; those are the
+documents to keep current. Nothing here depends on the `.skill` file being
+loaded, so do not treat its absence from the registered list as a bug, and do
+not "fix" it by moving it without deciding first whether a vendoring workflow
+belongs in a skill shipped to every installer at all.
+
 ### Why `vendor/` exists, and what goes in it
 
 The plugin ships its whole dependency tree because `hermes plugin install` does