ci: fix markdownlint config loading + osint-autopilot frontmatter

[elementalsouls]

Both lint jobs have been failing on main since 8dbbf0c — two unrelated causes, neither an actual content defect.

1. Markdown lint — config never loaded

The workflow fed rule config to markdownlint-cli2-action through the config: input:

config: |
  { "default": true, "MD013": false, ... }

But that input is a config-file path, not literal config. The action tried to open the JSON blob as a filename and died before linting a single file:

##[error]Failed due to error: Error: Unable to use configuration file '{

Moved the rules into an auto-discovered .markdownlint-cli2.jsonc at repo root and dropped the broken inline input.

2. The pre-existing violations that surfaced

Once config actually loaded, 479 violations appeared — all pre-existing, never enforced because the job had always errored out first. --fix cleared the mechanical set (blanks around fences/lists/headings, trailing whitespace, bare-URL wrapping, bullet-style normalization).

Three rules are disabled deliberately, consistent with the repo's existing MD013/MD024/MD025/MD033/MD041 disables:

Rule	Count	Why disabled, not fixed
MD040 fenced-code-language	128	Blocks are mostly mixed shell + output; a guessed language tag mislabels more than it documents
MD036 emphasis-as-heading	9	Docs use bold lead-ins as intentional style
MD037 / MD038 spaces-in-spans	4	Would corrupt technical tokens — see below

Why MD037/MD038 are off, not applied

--fix under those rules edited semantically-meaningful content:

• `_amazonses` — a DNS TXT record name — had its leading space eaten because the _ was parsed as an emphasis marker.
• Substring-match tokens like `access ` and `rdp ` (documented as "substring, lowercased") had trailing spaces stripped, changing what they match.

Stripping those is a content bug, so the rules are disabled rather than allowed to rewrite the tokens.

3. Two structural nits fixed by hand

• exposure-risk-quantification/SKILL.md — self-test list had a doubled 14. (items ran 1…14, 14, 15). Renumbered to 15, 16.
• identity-provider-recon/SKILL.md — a hard-wrapped sentence whose wrap point put - at line start, creating a false single-item list. Removed the stray bullet so it rejoins the paragraph.

4. Frontmatter job — missing required fields

skills/osint-autopilot/SKILL.md had only name + description; the job requires version and triggers (≥5), which every other skill carries:

FAIL: skills/osint-autopilot/SKILL.md missing required field: version

Added version: 1.0 and 9 trigger phrases drawn from the skill's own description.

Verification

Against markdownlint-cli2@0.15.0 (the version action@v18 bundles):

$ npx markdownlint-cli2@0.15.0 "**/*.md" "#node_modules"
Linting: 37 file(s)
Summary: 0 error(s)

Frontmatter check (CI logic, all 9 skills): every one OK, triggers 9–127.

The whole markdown diff is blank-line/whitespace mechanics plus the four intentional edits above — confirmed with git diff --ignore-all-space, which shows only the URL-wrap, the two hand nits, and the autopilot frontmatter.

Not touched

scripts/sync-skill-content.sh --check warns Source missing: docs/full-skills/*.SKILL.full.md — pre-existing on main, unrelated, left alone.

🤖 Generated with Claude Code