chore(ci): add the Crabbox validation baseline

Problem

The August 28, 2026 single-repository org setup audit reports two remaining
strict-baseline gaps:

• Crabbox skill
• Crabbox CI/config

The release and governance work intentionally did not add a speculative remote
validation backend. The repository needs an explicit provider choice and a
Krillswitch-specific validation contract.

Recommended scope

• Choose either brokered AWS Crabbox or Blacksmith Testbox-through-Crabbox for
  broad trusted validation.
• Add .crabbox.yaml with repository-specific sync exclusions and only the
  environment names required by Krillswitch.
• Add .agents/skills/crabbox/SKILL.md with the exact supported commands,
  provider/id reporting, and cleanup rules.
• If a hydrate workflow is used, constrain runners with fixed trusted labels:
  self-hosted, crabbox, openclaw, and krillswitch, plus the dynamic
  lease label.
• Prove one clean broad validation run and rerun the org setup audit until both
  Crabbox gaps clear.

Do not change the npm trusted-publishing or Cloudflare deployment paths as part
of this work.