docs(contributor-growth): vendor-neutral skill descriptions for code-host and tracker activity

[Kaap10]

Summary

• Updates skill frontmatter and security copy across magpie-contributor-growth (activity-sweep, nomination, calibrate, and identity-map) to replace hardcoded "GitHub activity" phrasing with vendor-neutral "code-host and tracker activity" and "off-forge signal".
• Follows up on the Phase 4 vendor-neutrality work (feat(contributor-growth): name contract operations instead of gh; Jira as a tracker backend #1549 / Optimize the contributor-growth skill family #1348) where trackers can now be Jira or other issue backends alongside GitHub code hosting.
• Re-stamps exact measured_tokens with surface_hash and always-on frontmatter budgets ($\le 200$ tokens) fully preserved.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators)
• Other:

Test plan

• prek run --all-files passes (all line endings LF, trailing whitespace clean, SPDX comments verified).
• For Python packages touched: uv run pytest / ruff check / mypy passes
• For Groovy bridges touched: command-line invocation tested end-to-end
• For skill changes: eval suite passes for the affected skill (tools/skill-evals/evals/contributor-*).
• For skill behaviour changes: a new or updated eval fixture is included in this PR
• Other: measured_tokens verified with tiktoken (cl100k_base), surface_hash verified unchanged (headings untouched), and generate-labeler-config.py --check-coverage passed.

RFC-AI-0004 compliance

• HITL — any new mutation is gated on explicit user confirmation
• Sandbox — no new unrestricted host access; network reach declared in the adapter
• Vendor neutrality — placeholders (<PROJECT>, <tracker>, <upstream>, <security-list>) and generic code-host / tracker surfaces used in all skill prose.
• Conversational + correctable — agentic-override path documented if behaviour is adopter-tunable
• Write-access discipline — no autonomous outbound messages; drafts only, sent on confirmation
• Privacy LLM — private content does not reach a non-approved LLM; redactor invoked where needed

Linked issues

Refs #1348

Notes for reviewers (optional)

Follow-up item directly addressing @potiuk's note on #1348:

"updating three skill descriptions that still say 'GitHub activity' now that the tracker can be Jira."

[potiuk]

Thanks :)