Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

skills/implementing-siem-use-case-tuning/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: implementing-siem-use-case-tuning
-description: Tune SIEM detection rules to reduce false positives by analyzing alert
-  volumes, creating whitelists, adjusting thresholds, and measuring detection efficacy
-  metrics in Splunk and Elastic
+description: Tune SIEM detection rules in Splunk and Elastic to reduce false positives
+  by analyzing alert volumes, creating context-aware exclusion lists, adjusting
+  thresholds against environmental baselines, and measuring precision/recall efficacy
+  metrics. Use when a SOC is drowning in noisy alerts and needs to tune correlation
+  searches or detection rules, or when measuring and reporting alert-to-incident
+  conversion rates.
 domain: cybersecurity
 subdomain: security-operations
 tags: