Apply the danger-listing policy to every agent surface and escape llms-full metadata #91

Follow-up from the #90 review (commit bb7776d).

1. The danger-listing policy covers only llms-full.txt. /skills/<slug>.md still serves a danger listing's SKILL.md body under ## SKILL.md, unfenced (apps/web/app/lib/markdown/skill-markdown.ts), and MCP get_package still returns content for danger listings. Either make the three surfaces consistent or document the split as intended.
2. llms-full.txt writes metadata raw: description, name, author and category are not escaped (apps/web/app/lib/markdown/llms-txt.ts). A description that starts with three backticks or spans several lines can open a stray fence or inject a fake heading. Collapse newlines and escape a leading #, > and backticks.
3. Rows created before the scanner (risk_label = 'unknown') still have their bodies embedded. Say so in docs/api-reference.md, or treat them as caution.

Acceptance: the same risk policy applies on llms-full, .md and MCP, metadata cannot break the Markdown structure, and tests cover both.