ci: harden sync workflow; document install-time link resolution

Least-privilege GITHUB_TOKEN (contents: read) and SHA-pinned
actions/checkout for the workflow holding the catalog deploy key.
Note in skills/README.md why cross-skill links are sibling-relative.