skills README: correct discovery note (Claude Code reads .claude/skills only) + caveats

The earlier README said Claude Code reads .agents/skills/. Its docs list only .claude/skills/ locations
(symlinks followed). Adds the explicit-path rule for loops and known caveats on the vendored set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4upF5LVwmPDDqrhdUfnXh

.agents/skills/README.md

@@ -1,7 +1,13 @@
 # Skills (`.agents/skills/`)
 
-Vendored agent skills, Agent Skills spec (one folder per skill, `SKILL.md` + `references/`). Any seat that checks
-out this repo has them; Claude Code and Codex both read `.agents/skills/` (Claude Code also `.claude/skills/`).
+Vendored agent skills, Agent Skills spec (one folder per skill, `SKILL.md` + `references/`).
+
+**Who sees this folder.** Codex, Copilot/VS Code, Gemini CLI and most open-source harnesses (OpenCode, goose, Pi,
+OpenHands) read `.agents/skills/` natively. **Claude Code does not**: it reads `.claude/skills/` only (it does follow
+symlinked skill folders there). Until per-skill symlinks exist under `.claude/skills/`, and for every scheduled loop
+regardless of harness, name the skill by path in the prompt: "read `.agents/skills/<name>/SKILL.md` and follow it".
+Explicit pointers trigger far more reliably than description matching, so loops should do this anyway, and should
+load only the one to three skills the task needs.
 
 | Skill | What | Upstream |
 |---|---|---|
@@ -16,5 +22,13 @@ out this repo has them; Claude Code and Codex both read `.agents/skills/` (Claud
 Starter subset, 2026-10-14. The full marketingskills set is ~50 skills; add more by copying the folder from upstream
 (`evals/` folders left out on purpose). Update by re-vendoring; note the upstream version in the commit message.
 
+Known caveats:
+- `brag-slim` was built for Claude Opus 5.5; upstream sends other models to the full `/brag` workflow. Use it on Claude seats.
+- `copywriting` hands email and popup copy to sibling skills (`emails`, `popups`) that are not vendored here.
+- `social/references/listening.md` pulls untrusted public text (Reddit, HN, Bluesky, YouTube). Run listening in a seat
+  with no secrets, and let it write a digest rather than edit shared files.
+- Upstream's AGENTS.md tells agents to fetch `VERSIONS.md` from GitHub at runtime. That file is deliberately not
+  vendored; updates come in as reviewed diffs, never by an agent fetching at run time.
+
 First use: run `product-marketing` once per product and save its output as the product's marketing context, so the
-other skills have something to read.
+other skills have something to read. Change that file only by pull request.