fix(api): Zod-validate POST /api/github-skills + document new gate envs + pin merge-integrity actions

Three latent heavy-CI reds surfaced by the VPS validation dispatch (the fast
path never runs these gates):

- t06 route-validation: POST /api/github-skills destructured request.json()
  blind — a non-array 'targets' would .map-crash. Now validateBody(zod)
  with defaults preserved (Hard Rule #7). Guard:
  tests/unit/github-skills-route-validation.test.ts (4/4).
- env-doc-sync: document OMNIROUTE_SKIP_SYSTEM_TRUST (#6310) and the
  changelog-integrity gate envs CHANGELOG_BASE_REF/ALLOW_CHANGELOG_REMOVALS
  (#6300) in .env.example + ENVIRONMENT.md.
- zizmor ratchet: the new merge-integrity job's checkout/setup-node uses were
  unpinned (+1 finding, 160 > baseline 159); pinned by SHA -> 158 (< baseline).

.env.example

@@ -1725,6 +1725,16 @@ APP_LOG_TO_FILE=true
 # where the operator trusts the CA manually (e.g. via Node's extra-CA-certs mechanism).
 # OMNIROUTE_NO_SUDO=0
 
+# ── Test/CI-only guards (never needed in production) ──
+# Set automatically by tests/_setup/isolateDataDir.ts and the CI workflows: the
+# test suite must NEVER mutate the OS trust store (a fake test PEM installed via
+# update-ca-certificates broke all system TLS on a persistent runner, 2026-07-05).
+# OMNIROUTE_SKIP_SYSTEM_TRUST=1
+# check-changelog-integrity.mjs (anti CHANGELOG-eat gate): explicit base ref
+# override, and the justified-removal escape hatch for intentional bullet removals.
+# CHANGELOG_BASE_REF=origin/release/v0.0.0
+# ALLOW_CHANGELOG_REMOVALS=1
+
 # ── 1Proxy egress pool ──
 # Used by: src/lib/oneproxySync.ts — fetches proxy nodes from the OmniRoute
 # CrofAI 1Proxy service. Disable, override URL, or tune the import quality.