hunter-22: bounty discovery with a one-tap audit handoff to vuln-scanner

[Svector-anu]

what this adds

a new skill, hunter-22: calls ClawHunter's free bounty-discovery API (docs/ClawHunter-API.md), matches candidates against this agent's real, demonstrated capabilities (code, security-research, research, writing, dependency-analysis), and triages honestly rather than dumping the raw feed - drops anything that's content/social-growth work wearing a bounty costume (tweet threads, engagement farming, "get a creator to post X" outreach), keeps what maps to deliverable work. discovery only: no wallet, never claims or submits on the operator's behalf.

the part worth calling out

when a kept candidate is actually audit-shaped work - requires includes code/onchain, and the bounty body links a github repo - the notification gets a one-tap button:

{"text":"Audit owner/repo","callback_data":"run:vuln-scanner:owner/repo"}

tapping it dispatches vuln-scanner straight at that repo. still a human tap, never automatic - this skill's own guardrails say so explicitly. but it closes discovery -> audit into one motion instead of two disconnected skills, using the existing run:<skill>:<arg> callback scheme (docs/telegram-commands.md) with no new infra.

paired naturally with #863 (cargo-fuzz in vuln-scanner) - together, a bounty like the veilo one gets found, one tap away from a real audit with fuzzing behind it.

catalog housekeeping

registered enabled: false in aeon.yml (operator opts in, same as every other skill), in a new ported-from-derivative-instances section next to vuln-tracker/inbox-triage since it pairs with vuln-scanner directly now. regenerated catalog/skills.json + catalog/packs.json (bin/generate-skills-json, bin/generate-packs-json), added an icon glyph + regenerated the SVG assets (bin/generate-skill-icons), updated the full-catalog count/table in docs/skill-packs.md and the README link (73 -> 74), and ran eyebrow scan to add the lockfile entry - node scripts/validate-readme-catalog.mjs, node scripts/validate-skill-packs.mjs, and scripts/check-skill-categories.sh all pass clean.

one thing intentionally left alone: eyebrow scan also flagged drift on .claude/skills/aeon/SKILL.md - that file is untouched by this branch (diffs clean against upstream/main), so that's pre-existing lockfile drift on main, not something this PR should silently absorb. left it as-is.

scope

no capability changes to hunter-22's discovery logic beyond what's described above - this is the skill as it's been running, plus the audit-handoff wiring.