fix(skills): harden RCS evidence handoff against prompt injection

[sent-dm]

Summary

• classify all RCS launch evidence as untrusted, inert data
• replace free-form email synthesis with an allowlisted three-column checklist for user review and manual submission
• forbid fetching supplied URLs, parsing attachments, following embedded instructions, including secrets, or transmitting evidence
• add repository validation that preserves the security boundary and regenerate every packaged skill copy

Root cause

The previous RCS onboarding workflow routed customer-supplied URLs, message examples, consent wording, and support details into a prose handoff. That left no explicit trust boundary between third-party content and the agent composing the handoff, which triggered Snyk W011 for indirect prompt-injection exposure.

Impact

RCS onboarding still collects the information Sent needs, but the agent now performs only allowlisted structural handling. Supplied values remain quoted data, links remain unverified, and the user retains review and submission control.

Validation

• quick_validate.py packages/sent/skills/rcs-agent-onboarding
• scripts/validate.py
• scripts/test_validation_gates.py — all 19 unsafe-drift cases rejected
• generated root, Codex, portable-package, and Claude skill copies are byte-synchronized