torch-xpu-run: recovery path installs unreviewed transformers HEAD (`pip install git+https://…`)

`plugins/intel-gpu-ai-skills/skills/torch-xpu-run/SKILL.md:278-279` (current `main`, `0b4fafd`) offers installing from a git branch as the recovery path for an unrecognized model architecture:

```
- `model type '' Transformers does not recognize` -> installed
transformers is older than the model architecture. Upgrade or
pin per the model card; install from source if needed
(`pip install git+https://github.com/huggingface/transformers.git`).
```

## Why it is worth changing

A skill body is read by an agent that may act on it without a human between the sentence and the shell. This one resolves to arbitrary upstream `main` at the moment it runs — no release, no review, no reproducible version — installed into whatever environment the user is in. It is also the only `git+https://` install in the skill, and the sentence right before it already gives the correct instrument (`pin per the model card`).

Found while wiring [NVIDIA SkillSpector](https://github.com/NVIDIA/SkillSpector) into `intel/skills` CI, which imports this skill under a pin ([intel/skills#19](https://github.com/intel/skills/pull/19)). SkillSpector v2.11.2 reports it as `YR1`, severity HIGH, confidence 0.85, YARA rule `agent_skill_remote_bootstrap_execution` ("remote script or code download followed by execution/bootstrap installation"). It is the one finding in that scan of 33 skills that is neither a false positive nor accepted catalog policy, and it is left unsuppressed there on purpose.

## Suggested change

Prefer the released wheel, and pin a tag when a model card really needs a pre-release:

```diff
- `model type '' Transformers does not recognize` -> installed
transformers is older than the model architecture. Upgrade or
- pin per the model card; install from source if needed
- (`pip install git+https://github.com/huggingface/transformers.git`).
+ pin per the model card (`pip install -U transformers`, or
+ `pip install "transformers=="`). If the card
+ requires a pre-release, install a tag rather than the branch:
+ `pip install "git+https://github.com/huggingface/transformers.git@v4.57.0"`.
```

A tag is not immutable either, but it is a reviewed release rather than whatever `main` held that minute, and it makes the failure reproducible for the next person who hits it.

Happy to open the PR if you would rather have the patch than the issue — say which and it is one line.

Open plugins/intel-gpu-ai-skills/skills/torch-xpu-run/SKILL.md and inspect lines 278-279 in the recovery guidance. Replace the unpinned Transformers main-branch installation with the released-wheel and version-pin examples described in the issue, while showing a tagged source install only for pre-releases. Done means the recovery path no longer installs unreviewed main and remains reproducible.

Written by the indexing model from the issue text.