fix: guard install path + robust frontmatter parsing (#47) (#54)

Reapplies @MatrixNeoKozak's PR #47 onto current main (resolves the
bin/cli.mjs conflict with the star-nudge changes):
- resolve() the install target and refuse system-critical dirs
  (/, /usr, /etc, /root, ...) so a typo'd --target can't clobber the system
- skillcheck frontmatter parser tolerates leading whitespace and CRLF/LF



Claude-Session: https://claude.ai/code/session_016JWn5jRD5tcEFKrubjQ6Px

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: MatrixNeoKozak <MatrixNeoKozak@users.noreply.github.com>

scripts/skillcheck.mjs

@@ -22,10 +22,12 @@ const strict = args.includes('--strict');
 const asJson = args.includes('--json');
 
 function parseFrontmatter(text) {
-  const m = text.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
+  // Tolerate optional leading whitespace and CRLF/LF line endings so authored-on-Windows
+  // files don't produce false negatives.
+  const m = text.match(/^\s*---\r?\n([\s\S]*?)\r?\n\s*---\r?\n?([\s\S]*)$/);
   if (!m) return { meta: null, body: text };
   const meta = {};
-  for (const line of m[1].split('\n')) {
+  for (const line of m[1].split(/\r?\n/)) {
     const kv = line.match(/^(\w[\w-]*):\s*(.*)$/);
     if (kv) {
       let v = kv[2].trim();