Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

skills/recovering-from-ransomware-attack/SKILL.md

@@ -1,12 +1,11 @@
 ---
 name: recovering-from-ransomware-attack
-description: 'Executes structured recovery from a ransomware incident following NIST
-  and CISA frameworks, including environment isolation, forensic evidence preservation,
-  clean infrastructure rebuild, prioritized system restoration from verified backups,
-  credential reset, and validation against re-infection. Covers Active Directory recovery,
-  database restoration, and application stack rebuild in dependency order. Activates
-  for requests involving ransomware recovery, post-encryption restoration, or disaster
-  recovery from ransomware.
+description: 'Executes structured ransomware incident recovery following NIST/CISA
+  frameworks: environment isolation, forensic evidence preservation, clean infrastructure
+  rebuild, prioritized restoration from verified backups, credential reset, and
+  Active Directory/database recovery in dependency order. Use when recovering from
+  a ransomware attack, performing post-encryption restoration, or executing disaster
+  recovery after ransomware encryption.
 
   '
 domain: cybersecurity