docs: remediate Bundle A toolchain-freshness documentation drift

[jkim323]

Description

Remediates a cluster of documentation drift where recent code changes were not reflected in setup, contributing, and tooling docs. All edits stem from three merged changes:

• uv.lock Dependabot requirement (PR chore(build): dependabot uv moderation coverage + dependency remediation #2237) — Python skills must commit uv.lock; validate:skills warns when it is missing.
• PowerShell 7.4 runtime floor (PR build(scripts): adopt PowerShell 7.4 floor repo-wide #1842) — #Requires -Version 7.4 is now mandatory across scripts.
• osv-scanner tool addition (PR VEX (Vulnerability Exploitability eXchange) capability #2038) — installed in both the DevContainer and the coding agent.

Nine documentation issues are fixed across five files in a single coherent pass:

• docs/contributing/skills.md — qualify the scripts/ .ps1 requirement to PowerShell/cross-platform skills and document the Python package pattern; add the isort "I" rule and the uv.lock/Dependabot requirement; mark Python CI coverage as Full (lint + test); correct Section 8 so SKILL.md must not carry the attribution footer; add #Requires -Version 7.4 plus a cross-reference to the PowerShell instructions.
• docs/customization/environment.md — update PowerShell 7 → 7.4 in four places; add osv-scanner to the Pre-Installed Tools list and the Shared Tools table.
• .github/copilot-instructions.md — add the required uv.lock bullet to the Python Skill Configuration section.
• scripts/linting/README.md — document the new uv.lock warning in the Validate-SkillStructure.ps1 feature list.
• .devcontainer/README.md — add osv-scanner under the Security tools subsection.

ms.date frontmatter was refreshed to 2026-06-30 on the edited files that carry it.

Related Issue(s)

Closes #1868
Closes #2258
Closes #2268
Closes #2305
Closes #2286
Closes #2304
Closes #2257
Closes #2256
Closes #2287

Type of Change

Select all that apply:

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update

Infrastructure & Configuration:

• GitHub Actions workflow
• Linting configuration (markdown, PowerShell, etc.)
• Security configuration
• DevContainer configuration
• Dependency update

AI Artifacts:

• Reviewed contribution with prompt-builder agent and addressed all feedback
• Copilot instructions (.github/instructions/*.instructions.md)
• Copilot prompt (.github/prompts/*.prompt.md)
• Copilot agent (.github/agents/*.agent.md)
• Copilot skill (.github/skills/*/SKILL.md)
• Copilot hook (.github/hooks/*/*.json)
• Eval spec added/updated for changed AI artifacts (evals/)

Other:

• Script/automation (.ps1, .sh, .py)
• Other (please describe):

Sample Prompts (for AI Artifact Contributions)

Not applicable — this PR contains documentation changes only, no AI artifacts.

Testing

Automated validation run locally against the changed files:

• npm run lint:md — pass (0 errors, 261 files)
• npm run lint:frontmatter — pass (0 errors / 0 warnings, 801 files)
• npm run spell-check — pass (0 issues, 1176 files)
• npm run format:tables — pass (no changes needed)
• npx markdownlint-cli2 docs/contributing/skills.md — pass (post link-fix)
• npm run lint:md-links — deferred to CI; the repo-wide run is network-bound across all markdown files. The one new relative link (skills.md → powershell.instructions.md) was corrected to a full GitHub blob URL matching the Bash section pattern and verified to resolve.

Manual testing: not applicable (documentation-only).

Checklist

Required Checks

• Documentation is updated (if applicable)
• Files follow existing naming conventions
• Changes are backwards compatible (if applicable)
• Tests added for new functionality (if applicable)

AI Artifact Contributions

• Used /prompt-analyze to review contribution
• Addressed all feedback from prompt-builder review
• Verified contribution follows common standards and type-specific requirements

Required Automated Checks

The following validation commands must pass before merging:

• Markdown linting: npm run lint:md
• Spell checking: npm run spell-check
• Frontmatter validation: npm run lint:frontmatter
• Skill structure validation: npm run validate:skills
• Link validation: npm run lint:md-links
• PowerShell analysis: npm run lint:ps
• Eval spec schema and coverage (if AI artifacts changed): npm run eval:lint:schema
• Plugin freshness: npm run plugin:generate
• Docusaurus tests: npm run docs:test

Security Considerations

• This PR does not contain any sensitive or NDA information
• Any new dependencies have been reviewed for security issues
• Security-related scripts follow the principle of least privilege

Additional Notes

• Issue docs: Document skill auto-coverage and uv.lock requirement in Prompt-Builder instructions #2234 needs no code change — .github/instructions/hve-core/prompt-builder.instructions.md already documents the uv.lock/Dependabot guidance. Recommend closing it as already-completed.
• Two files carried multiple issues and were edited in one collision-free pass: skills.md (4 issues) and environment.md (2 issues).

[github-actions]

Eval Execution

⚠️ No eval summary was produced.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.64%. Comparing base (64c47ac) to head (94d910e).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2317      +/-   ##
==========================================
- Coverage   81.64%   81.64%   -0.01%     
==========================================
  Files         130      130              
  Lines       19470    19470              
  Branches       12       12              
==========================================
- Hits        15897    15896       -1     
- Misses       3570     3571       +1     
  Partials        3        3              

Flag	Coverage Δ
docusaurus	61.84% <ø> (ø)
pester	86.02% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.