chore: retire the single-record bundled Skill provenance schema

[rbalachandar]

Summary

packages/runtime/resources/bundled-skills/provenance.json held one record and had no consumers: scripts/gen-bundled-skill-catalog.mjs reads only <id>/SKILL.md, and the sole reference in the tree was docs/code-origin-audit.md. The schema was built for the batch that #2695 resolved — 29 Skills went, one stayed.

This PR deletes the file and moves the computer-use Skill's origin, AI-assistance, and review facts into the "Bundled Skills" section of docs/code-origin-audit.md, which already had to be touched to remove the provenance.json reference.

The issue's two constraints are preserved:

• The record stays out of SKILL.md, so provenance edits never change installed Skill content hashes — the property the deleted file existed to hold.
• It does not touch docs/computer-use-provenance.md, which registers third-party material; this Skill is origin: independently-authored.

Every fact is carried over verbatim from the deleted JSON (author Haoqing Wang / @hqhq1025, OpenAI Codex drafting assistance, inputs list, introduction via #2147 at 2fb83e20, contributor confirmation 2026-08-11, independent review in #2676 at 3c7683b9 on 2026-08-12 with its scope caveat), anchored to fixed commits so the historical audit report is not turned into mutable living state.

Fixes #3424

Verification

• npm run generate:bundled-skills -- --check — catalog unaffected (the generator never read the JSON)
• npm run format:check, npm run typecheck, npm run check:asf-headers
• Repo-wide search confirms no remaining references to provenance.json
• Not run: npm run lint, npm run build, knip — no code changed; CI covers them

Review focus

One tradeoff worth flagging: docs/code-origin-audit.md is a dated evidence report. Folding the record in means any future bundled-Skill provenance update edits a historical document; if more Skills are bundled later, a dedicated provenance home may be worth revisiting.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: opencode explored the repository, drafted both the doc change and this description, and proposed the record's new home (selected by the human contributor of record, who reviewed every fact against the deleted JSON before submitting). The commit carries a Generated-by: opencode trailer.

Checklist

• Tests cover the change and fail without it — not applicable: resource-file deletion plus documentation; nothing testable changed (catalog generator check confirms behavior is unchanged)
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• No

[Astro-Han]

I reviewed this head and found no blocking issues.

The retirement removes a retired bundled Skill provenance schema (schemaVersion 1 / unresolvedGroups metadata) while preserving all substantive facts in code-origin-audit. No hidden consumers remain (generator still scans SKILL.md directories, SHA unchanged). Document hygiene is maintained and checks are green.

No P0-P3.

简体中文

该头未发现阻断。

[Astro-Han]

APPROVE — 4854b5b, no P0-P3, provenance correctly retired.