feat(plugin): ship the repo's skills as ccam plugin skills

The repo root already IS the `ccam` plugin root (`"source": "./"`), so the
conventional `skills/` dir at the root is the plugin's skills dir — while
`.claude/skills/` only loaded for a session whose cwd was inside this
checkout. That is useless for a lane working in another repo, which is why
`ccam skills install` existed at all.

Move all seven skills to `skills/`: they now reach every plugin user as
`/ccam:<name>` (bare `/<name>` as an alias). `ccam skills install` stays as
the fallback for a plain checkout without the plugin, sourcing from the new
path.

Agents deliberately do NOT move. A plugin agent is addressed as
`ccam:qc-local`, which would break the `subagent_type: qc-local` references
in ship-feature-lane; `ccam lanes agents install` keeps writing them into the
lane's own `.claude/agents/`, the highest-priority agent source. MCP was
already plugin-shipped via `plugins/ccam/.mcp.json`.

Mechanical fallout: ~115 source files carry a doc-comment pointer to
`.claude/skills/file-headers/`, repointed to `skills/file-headers/`. The
generic Claude Code config-surface examples in openapi/cc-config (`.claude/
skills/code-reviewer`) describe any user's layout and are left alone.

Also fixes the two file-headers scripts, whose `ROOT=` climbed four levels
from `.claude/skills/file-headers/scripts/` and would have escaped the repo
from the new depth — it scanned sibling projects until corrected to three.

npm run test:server (1160 pass), test:client (422 pass), mcp:typecheck,
mcp:build + mcp:check-build all green.

docs/PLUGINS.md

@@ -88,6 +88,21 @@ checkout unnecessary.
 | The MCP tools | `plugins/ccam/.mcp.json`, pointing at the committed `mcp/build/index.js` |
 | The dashboard UI (`/run` and every other client route) | built into the runtime dir by the bootstrap, so it works the moment `claude` starts |
 | `/ccam-doctor`, `/ccam-update`, `/ccam-open` | `plugins/ccam/commands/` |
+| The skills (`ship-feature-lane`, `ship-feature`, `repo-onboarding`, `debug-live-issue`, `mcp-operations`, `update-project-docs`, `file-headers`) | `skills/` at the repo root — which IS the plugin root, so they are auto-discovered as plugin skills |
+
+Plugin skills are namespaced: they are invoked as `/ccam:<name>`, with the bare
+`/<name>` working as an alias unless another skill or command claims that name.
+This is why `skills/` sits at the repo root instead of `.claude/skills/` — the
+latter only loads for a session whose cwd is inside this checkout, which is
+useless for a lane working in a different repo. `ccam skills install` survives
+as the fallback for a plain checkout without the plugin.
+
+**Agents are deliberately not shipped this way.** `.claude/agents/` stays
+repo-local, and the lane agents (`qc-local`, `senior-gate-reviewer`) are
+installed per-lane by `ccam lanes agents install`. A plugin agent would be
+addressed as `ccam:qc-local`, breaking the `subagent_type: qc-local` references
+in the pipeline skill; the per-lane copy also lands in the highest-priority
+agent source.
 
 Because the plugin ships the hooks itself, `npm run install-hooks` is not needed
 for plugin users — and must not be run alongside it. Events carry no id, so two