Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

skills/performing-ransomware-response/SKILL.md

@@ -1,11 +1,10 @@
 ---
 name: performing-ransomware-response
-description: 'Executes a structured ransomware incident response from initial detection
-  through containment, forensic analysis, decryption assessment, recovery, and post-incident
-  hardening. Addresses ransom negotiation considerations, backup integrity verification,
-  and regulatory notification requirements. Activates for requests involving ransomware
-  response, ransomware recovery, crypto-ransomware, data encryption attack, ransom
-  payment decision, or ransomware containment.
+description: 'Executes a structured ransomware incident response from detection through
+  containment, forensic analysis, decryption assessment, recovery, and post-incident
+  hardening, covering ransom negotiation, backup integrity verification, and regulatory
+  notification. Use when actively responding to a ransomware outbreak or crypto-ransomware
+  infection, or deciding on ransom payment and containment steps.
 
   '
 domain: cybersecurity