Add loader + protocol for the 42 x.klickd v4.1 skill packs

[Davincc77]

Summary

Makes the public developer story for the 42 x.klickd v4.1 candidate skill packs (8 Lite + 34 Pro) complete and verifiable, without overclaiming. Turns four prior gaps into yes:

1. Public loaders can load the 42 packs by id / filename / pack (@klickd/core, klickd PyPI, and a no-install CLI).
2. Protocol docs state the artifact_loaded + hash-verified contract before a skill may be called "used".
3. Package/CLI paths for loading / listing / verifying the 42 packs are exposed and documented.
4. A dedicated page explains how to use the packs safely, including the truth boundary.

What changed

@klickd/core (npm >= 4.1) — bundles the 42 packs + manifest under x-klickd-skills/ (same pattern as the existing starter-skills/) and adds:

• listXKlickdSkillPacks(), getXKlickdSkillPackBytes(idOrFilenameOrPack), loadXKlickdSkillPack(idOrFilenameOrPack), getXKlickdSkillsManifest(), getXKlickdSkillsDir().
• loadXKlickdSkillPack returns a summary with artifact_loaded: true, id, tier, file, pack, sha256, sha256_matches_manifest, competency_ids, gates, evidence_policy, human_authority/human_veto, plus envelope fields.

klickd (PyPI >= 4.1) — same bundling under klickd/x_klickd_skills/ and list_xklickd_skill_packs() / get_xklickd_skill_pack_bytes() / load_xklickd_skill_pack() (+ manifest/dir accessors).

scripts/verify_xklickd_skill_packs.py — dependency-free verifier and CLI (verify / list / load). verify checks: 42 total (8 Lite + 34 Pro), every .klickd parses as JSON, required fields present (klickd_version, payload_schema_version, domain, profile_kind, x_klickd_pack, x_klickd_pack.pack), and SHA-256 matches the manifest.

Docs — new docs/integrations/skill-loader-protocol.md (truth boundary + artifact_loaded contract + Python/Node/CLI examples). Linked from docs/getting-started.md, docs/integrations/README.md, the main README.md, and both package READMEs.

Truth boundary (no overclaims)

The packs are real JSON .klickd artifacts, not native skills in any assistant, not a v4.1 GA release. A pack is only "used" once artifact_loaded and sha256_matches_manifest are both true, or a host runtime has explicitly integrated it. No universal-standard, automatic GDPR / EU AI Act, or benchmark-superiority claims are introduced. The repo tree under examples/v4.1/x-klickd-skills/ stays authoritative; bundled package copies are byte-identical mirrors verified by the test suites.

Test plan

• @klickd/core: npm test -> 107 passed (incl. new x-klickd-skills.test.ts).
• @klickd/core: npm run verify:tarball -> CJS + ESM smoke OK (42 packs ship + load/verify from the packed tarball).
• klickd (PyPI): pytest -> 109 passed, 1 skipped (incl. new test_x_klickd_skills.py).
• python -m build --wheel bundles all 42 .klickd + manifest; installed-wheel API returns verified artifact_loaded.
• python scripts/verify_xklickd_skill_packs.py verify -> OK (8 Lite, 34 Pro).

---

🤖 Generated by Computer