The guard previously scanned only SKILL.md files, but skill_view serves
references/, templates/ and scripts/ content verbatim too, so a token inside
a referenced doc travels into later requests just the same. Scan every
bundled *.md under skills/ and optional-skills/ instead (the .hub cache
stays excluded), and move the test to tests/skills/ beside the other
bundled-skill doc contract tests.
Mutation-checked: injecting the token into a references/*.md turns the suite
red; restoring turns it green.
(cherry picked from commit 52d2e4e3dbda9d99151696b889e79cd8ca44a73c)
2f878931ed