Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

skills/analyzing-windows-amcache-artifacts/SKILL.md

@@ -1,12 +1,10 @@
 ---
 name: analyzing-windows-amcache-artifacts
-description: 'Parses and analyzes the Windows Amcache.hve registry hive to extract
-  evidence of program execution, application installation, and driver loading for
-  digital forensics investigations. Uses Eric Zimmerman''s AmcacheParser and Timeline
-  Explorer for artifact extraction, SHA-1 hash correlation with threat intel, and
-  timeline reconstruction. Activates for requests involving Amcache forensics, program
-  execution evidence, Windows artifact analysis, or application compatibility cache
-  investigation.
+description: 'Parses the Windows Amcache.hve registry hive with Eric Zimmerman''s
+  AmcacheParser and Timeline Explorer to extract evidence of program execution, application
+  installation, and driver loading, including SHA-1 hash correlation with threat
+  intel and timeline reconstruction. Use for Amcache forensics, program execution
+  evidence gathering, or application compatibility cache investigations in DFIR work.
 
   '
 domain: cybersecurity