chore: update vendored skills and record provenance

humanizer 2.2.0 -> 2.9.1 (blader/humanizer, MIT): adds a Voice
Calibration section and a passive-voice pattern, reworks negative
parallelisms and em dashes. Version moved to metadata.version upstream.

impeccable 3.6.0 -> 4.0.4 (pbakaus/impeccable, Apache-2.0): the repo
tags the skill and the npm CLI separately, so 3.6.0 was a real release
and npm's 3.5.0 was never the comparison. Adds native-platform reference
briefs.

Each now carries an UPSTREAM file; bin/check-vendored.sh reports drift.

bin/check-vendored.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Reports vendored skills that have moved upstream. Read-only; never updates.
+set -uo pipefail
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+stale=0
+
+for f in "$REPO"/skills/*/UPSTREAM; do
+  [ -e "$f" ] || continue
+  name="$(basename "$(dirname "$f")")"
+  # shellcheck disable=SC1090
+  repo=; ref=; while IFS='=' read -r k v; do case "$k" in repo) repo=$v;; ref) ref=$v;; esac; done < "$f"
+
+  # Tag series is whatever prefixes the pinned ref, so a repo that tags its
+  # skill and its CLI separately does not report the CLI's tags as drift.
+  prefix="${ref%%[0-9]*}"
+  latest="$(git ls-remote --tags --refs "$repo" 2>/dev/null \
+    | awk -F/ '{print $NF}' \
+    | grep -E "^${prefix}[0-9]" \
+    | sort -V | tail -1)"
+
+  if [ -z "$latest" ]; then
+    printf '  ?  %-14s %s (could not reach %s)\n' "$name" "$ref" "$repo"
+  elif [ "$latest" = "$ref" ]; then
+    printf '  ok %-14s %s\n' "$name" "$ref"
+  else
+    printf '  !! %-14s %s -> %s\n' "$name" "$ref" "$latest"
+    stale=$((stale + 1))
+  fi
+done
+
+[ "$stale" -gt 0 ] && echo && echo "$stale vendored skill(s) behind upstream."
+exit 0