feat(tester): add catalog-driven black-box test skill

Maintain and run project test catalogs under .pouch/tester, filtered by
category, id, and risk (safe/act/harm). Scripts generate the human CSV
from cases YAML.

skills/tester/templates/catalog.yaml

@@ -0,0 +1,26 @@
+version: 1
+updatedAt: "1970-01-01T00:00:00+00:00"
+project:
+  name: ""
+id_pattern: "^[A-Z]+-[A-Za-z0-9-]+$"
+categories: []
+risks:
+  - safe
+  - act
+  - harm
+default_max_risk: safe
+vars: {}
+auth_env:
+  act: AUTHORIZE_ACT
+  harm: AUTHORIZE_HARM
+gates: {}
+sessions:
+  browser:
+    kind: browser
+    reuse: run
+    init: "打开目标页面"
+  mobile:
+    kind: mobile
+    reuse: persist
+    probe: ""
+    init: ""

skills/tester/templates/local.yaml.example

@@ -0,0 +1,4 @@
+# 复制为 .pouch/tester/local.yaml 后填写。不要提交 local.yaml。
+HOST: ""
+AUTHORIZE_ACT: false
+AUTHORIZE_HARM: false