feat(redact): gen-skill-docs resolver for taxonomy table + invocation block

scripts/resolvers/redact-doc.ts emits two placeholders, both derived from
lib/redact-patterns so skill docs never drift from the engine:

- {{REDACT_TAXONOMY_TABLE}} — 3-tier table for /spec + /cso (shared source).
- {{REDACT_INVOCATION_BLOCK:<sink>}} — the canonical scan-at-sink bash + prose
  for one enforcement point (pre-codex/pre-issue/pre-archive/pre-pr-body/
  pre-pr-title/pre-commit): which-bun probe, visibility resolution (local config
  → gh → glab → unknown), temp-file scan-at-sink, exit 3/2/0 branches, PII
  auto-redact offer, guardrail-not-enforcement framing.

Registered in index.ts. 12 resolver tests. No SKILL.md churn yet (no template
references the placeholders until the per-skill wiring commits).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/resolvers/index.ts

@@ -34,10 +34,13 @@ import { generateGBrainContextLoad, generateGBrainSaveResults } from './gbrain';
 import { generateQuestionPreferenceCheck, generateQuestionLog, generateInlineTuneFeedback } from './question-tuning';
 import { generateMakePdfSetup } from './make-pdf';
 import { generateTasksSectionEmit, generateTasksSectionAggregate } from './tasks-section';
+import { generateRedactTaxonomyTable, generateRedactInvocationBlock } from './redact-doc';
 
 export const RESOLVERS: Record<string, ResolverValue> = {
   SLUG_EVAL: generateSlugEval,
   SLUG_SETUP: generateSlugSetup,
+  REDACT_TAXONOMY_TABLE: generateRedactTaxonomyTable,
+  REDACT_INVOCATION_BLOCK: generateRedactInvocationBlock,
   COMMAND_REFERENCE: generateCommandReference,
   SNAPSHOT_FLAGS: generateSnapshotFlags,
   PREAMBLE: generatePreamble,