docs(onboarding): refresh runbook and add how-to-install-a-skill

[devin-ai-integration]

Summary

Updates docs/runbooks/onboarding.md to match the current yyos workflow I verified locally on this repo, and adds a new section explaining how to install and run a skill (which was missing).

Notable doc changes:

• Step 1: noted the repo is now public, so permissions are only required for write access.
• Step 3: added PATH export hint (the install script prints it), a verify one-liner, the one-click install_all_features.sh path, and an os → yyos deprecation callout.
• Step 4: documented --confirm-install-missing-skills (yyos 1 can output missing_skills) and --confirm-high-risk-execution for high-risk selections.
• New Step 6 ("如何安装并运行一个 skill"): two install paths (auto-discover via find-skills, manual from pinned GitHub ref with verify_skill_source.py whitelist check), how to verify install, and how to run a skill via YYOS routing vs. direct script invocation; links to missing-skill-policy.md.
• Step 8: added a --json dry-run preview before --confirm-bootstrap-apply.
• Step 9: bumped Node hint to 18+ (required by npx --yes skills ...) and added the ~/.local/bin PATH reminder.

No code changes.

Review & Testing Checklist for Human

• Confirm the new "如何安装并运行一个 skill" section matches the team's intended install UX — in particular, that npx --yes skills add ... --skill <name> -y and ~/.codex/skills/<skill-name> are the correct/official path and CLI invocation for your environment.
• Verify yyos 安装github和mcp --json actually emits the bootstrap plan in your environment. In my local run it returned a low-confidence clarification prompt instead of a bootstrap block; if --json alone is insufficient, the doc should instead suggest a different preview flag (e.g. require --confirm-bootstrap-apply --dry-run or similar).
• Sanity-check the install_all_features.sh description (reads SKILL_MATRIX, runs install_yyos_command.sh, self-checks with yyos --json, supports --dry-run/--force) still matches the current script.

Notes

• All other steps were exercised locally on a fresh clone (Python 3.12.8, Node 22) and worked: install script created ~/.local/bin/yyos, yyos, yyos 1, yyos 检查MCP状态, yyos 优化发布链路 --discover-ecosystem, yyos 1 --confirm-install-missing-skills, and python3 skills/yyos/scripts/yyos_dashboard.py all returned expected output.
• Kept the doc in Chinese to match the existing runbook style.

Link to Devin session: https://app.devin.ai/sessions/f81dd425de3f4a4da3ef47a2415bed0e
Requested by: @Qingjingyu

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring