Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

skills/executing-red-team-exercise/SKILL.md

@@ -1,13 +1,11 @@
 ---
 name: executing-red-team-exercise
-description: 'Executes comprehensive red team exercises that simulate real-world adversary
-  operations against an organization''s people, processes, and technology. The red
-  team operates with stealth as a primary objective, employing the full attack lifecycle
-  from initial reconnaissance through objective completion while testing the organization''s
-  detection and response capabilities. This differs from penetration testing by focusing
-  on adversary emulation rather than vulnerability identification. Activates for requests
-  involving red team exercise, adversary simulation, adversary emulation, or full-scope
-  offensive security assessment.
+description: 'Run a stealthy, MITRE ATT&CK-mapped adversary emulation against an organization''s
+  people, processes, and technology, using C2 infrastructure (Cobalt Strike, Sliver, Brute
+  Ratel, Mythic) through the full attack lifecycle to test SOC detection and response rather
+  than just find vulnerabilities. Use when executing a full-scope red team exercise, adversary
+  simulation/emulation, or a regulatory exercise (TIBER-EU, CBEST, AASE, iCAST) with executive
+  authorization and a signed Rules of Engagement already in place.
 
   '
 domain: cybersecurity