docs: document transitive skill dependencies and trust model

[pablocabrera85]

Summary

Phase 4 of #68 (final step, after the feature has landed). Document the shipped behavior for end users.

Scope

• Update README.md and the docs site (docs/reference/ and docs/guide/) to describe: how nested ai.json dependencies work, how to opt in, the version-conflict error users may see and how to resolve it, and the security/trust-model rationale for the opt-in default (skills can carry executable agent instructions).
• Keep README.md and docs/ in sync per the repo's path-map convention.

Relevant code

• README.md, docs/reference/, docs/guide/

Part of #68.

[pablocabrera85]

Amendment (post-review, see #68 "Design decisions v2"): also document the hard recursion depth cap, the transitive skill naming scheme (so users can predict/find a transitive skill's materialized directory name), and that a nested dependency's own resolveTransitive/plugins declarations are ignored by design.