Codex/fix readme video links (#76)

* fix(readme): use github-safe demo previews and links

* fix(readme): use only github-hosted demo links

* fix(wiki): map wiki root to index

* feat(readme): add lightweight animated gif demo previews

* refactor(wiki): generate Home from INDEX during sync

* fix(ci): remove github token write scopes in workflows

* chore(ci): use existing poll token for write automation

.github/workflows/skill-release.yml

@@ -540,7 +540,7 @@ jobs:
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
     outputs:
       skill_name: ${{ steps.parse.outputs.skill_name }}
       version: ${{ steps.parse.outputs.version }}
@@ -877,6 +877,15 @@ jobs:
             } >> $GITHUB_OUTPUT
           fi
 
+      - name: Require automation token for release publishing
+        env:
+          AUTOMATION_TOKEN: ${{ secrets.POLL_NVD_CVES_PAT }}
+        run: |
+          if [ -z "$AUTOMATION_TOKEN" ]; then
+            echo "::error::Set POLL_NVD_CVES_PAT with repo write permissions."
+            exit 1
+          fi
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
         with:
@@ -936,7 +945,7 @@ jobs:
           draft: false
           prerelease: ${{ contains(github.ref_name, 'alpha') || contains(github.ref_name, 'beta') || contains(github.ref_name, 'rc') }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.POLL_NVD_CVES_PAT }}
 
       - name: Delete superseded releases
         run: |
@@ -973,7 +982,7 @@ jobs:
 
           echo "Superseded release cleanup complete"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.POLL_NVD_CVES_PAT }}
 
   publish-clawhub:
     # Separate job for ClawHub publishing - runs after GitHub release