fix: rebrand Open Skills to Hasna Skills, scrub internal domain/infra leak

[andrei-hasna]

Summary

• Rebrands the product name "Open Skills" -> "Hasna Skills" in user-facing copy (README, CONTRIBUTING, CLI storage output text, source file headers). Does not touch the open-skills identifiers, the hasna/skills repo name, the @hasna/skills package name, or the open source phrase.
• Scrubs an internal-infra leak: the internal skills.hasna.xyz domain was hardcoded as the CLI's default self-hosted API origin (DEFAULT_SELF_HOSTED_API_URL), in README examples, in architecture/product docs, and in several test fixtures. Hosted/default references now point at the public skills.md domain (matching the existing "skills.md": "self-hosted" alias already in src/lib/config.ts); generic "point at your own self-hosted registry" examples now use a neutral placeholder (https://your-server.example / example.com) instead of a real-looking internal host.
• .github/workflows/deploy.yml: removed the hardcoded real AWS account ID from the workflow env: block and switched the IAM role-to-assume ARN to read the account ID from a secrets.AWS_ACCOUNT_ID GitHub Actions secret instead of a plaintext value in the repo. Updated the smoke-test health check domain to skills.md to match the new default.

Not done (needs a human/operator decision, flagged rather than guessed)

• AWS_ACCOUNT_ID GitHub secret must be added to this repo before this workflow will function — I removed the plaintext value from the file but did not (and should not, as an automated change) provision the actual secret. Deploys will fail closed until an admin adds it.
• I did not delete .github/workflows/deploy.yml outright (one option raised during review). It's the production deploy workflow (push: branches: [main] -> real ECS/Fargate deploy); removing it would disable production deploys unless an equivalent pipeline already exists elsewhere. That's an availability decision outside what this PR should decide unilaterally.
• The previously-hardcoded AWS account ID and role ARN pattern remain visible in this repo's git history (prior commits). Editing the current file does not retroactively scrub history; a real remediation (history rewrite / force-push, or treating the exposure as already-public and rotating trust boundaries instead) is a separate, larger decision for the infra owner.
• /hasna/deploy/${APP} SSM parameter naming convention in deploy.yml was left as-is — low-sensitivity naming detail (not a credential), using the existing non-secret APP env var.

Test plan

• bun install
• bun run build (CLI, MCP, server, worker, migrate, library all bundle cleanly)
• bun test — 727 pass, 0 fail
• Repo-wide grep confirms no remaining Open Skills, hasna.xyz, or the literal AWS account ID