v0.2.0: add Linux server resident-agent route + ops-workflow discipline

- scripts/agent.py: GLM-vision WeChat guard agent (8s watch loop, red-dot
  detection, whitelist, title-verify gate, rate/quiet-hours caps, self-heal)
- scripts/setup-server.sh: idempotent xfce+TigerVNC+noVNC+WeChat-Linux setup
- scripts/check-skill.sh: skill guard (structure/secrets/privacy/claims/
  encoding/syntax/CHANGELOG/bundle parity), self-exclusion aware
- references/linux-server.md: deploy & ops guide for the 7x24 route
- references/pitfalls-linux.md: 17 field-tested pitfalls
- references/ops-workflow.md: baseline-first authoring + sync discipline
  (methodology credit: octopus-workflow)
- SKILL.md/README: dual-platform entry; CHANGELOG added

scripts/wechat-agent.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=WeChat GUI Agent (GLM brain)
+After=tigervncserver@:1.service
+Wants=tigervncserver@:1.service
+
+[Service]
+Environment=DISPLAY=:1
+Environment=HOME=/root
+WorkingDirectory=/opt/wechat-agent
+ExecStart=/usr/bin/python3 /opt/wechat-agent/agent.py
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target