docs: add OpenClaw plugin evaluation guide

[kriptoburak]

What this PR does

Adds a SkillCompass example guide for reviewing networked OpenClaw plugins before allowing tools, API keys, or private workflows. The guide uses TweetClaw as a concrete example because it covers read, write, media, direct-message, monitor, webhook, and giveaway workflows.

The guide adds a practical install-gate workflow for OpenClaw users who want to evaluate action-oriented skills before enabling live tools. Its install guidance now uses TweetClaw's verified ClawHub source and documents the npm fallback separately.

Independent repository fix

• updates the direct js-yaml dependency and lockfile from vulnerable 4.1.1 to patched 4.3.0
• removes the moderate merge-alias quadratic-complexity denial-of-service advisory
• preserves the existing Node 18 support and verification behavior

How I verified

• npm ci
• npm ci --prefix oc
• npm run build:oc
• npm run verify:local
• npm audit --audit-level=low reports 0 vulnerabilities
• git diff --check
• verified the TweetClaw repository, ClawHub page, and npm registry record
• verified npm registry metadata reports @xquik/tweetclaw version 1.6.37
• confirmed the branch targets dev

Checklist

• No secrets or credentials in the diff
• Conventional commit message
• Feature and fix PR targets dev
• Self-reviewed the complete diff
• No prompts/ or lib/ files changed
• AI-assisted content was reviewed by the submitter

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.

[kriptoburak]

Independent repository repair published in 2246ac0. The root dependency and lockfile now use patched js-yaml 4.3.0 instead of vulnerable 4.1.1, removing the merge-alias quadratic-complexity denial-of-service advisory. npm ci, the OpenClaw TypeScript build, the complete local verifier, a zero-vulnerability npm audit, live link checks, and git diff --check pass. I also audited every comment, review, thread, check, conflict, review request, and lifecycle state; no unresolved feedback remains.

[kriptoburak]

Rebuilt this PR on the current dev head as exactly 1 signed commit.

The repair preserves the independent js-yaml vulnerability fix and corrects the TweetClaw guide to use the verified ClawHub install source, with npm documented as the fallback.

Fresh validation passed:

• root and OpenClaw dependency installs
• OpenClaw TypeScript build
• complete local verifier
• npm audit with 0 vulnerabilities
• live source, ClawHub, and registry checks
• git diff --check

I also re-audited every comment, review, review request, thread, check, issue, conflict, commit, and lifecycle event. No contributor work remains.