Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

skills/performing-memory-forensics-with-volatility3/SKILL.md

@@ -1,7 +1,11 @@
 ---
 name: performing-memory-forensics-with-volatility3
-description: Analyze volatile memory dumps using Volatility 3 to extract running processes,
-  network connections, loaded modules, and evidence of malicious activity.
+description: Analyze volatile memory (RAM) dumps using the Volatility 3 framework
+  to extract running processes, network connections, loaded modules, credentials,
+  and encryption keys, and to detect process hollowing, DLL injection, or hidden
+  processes/rootkits. Use during incident response on a compromised or suspect system
+  when disk-based forensics alone is insufficient and volatile evidence of malware
+  or intrusion must be recovered from memory.
 domain: cybersecurity
 subdomain: digital-forensics
 tags: