writing-guidelines: pin the rules instead of fetching them from `main` at runtime

The writing-guidelines skill fetches its rules before every review from:

https://raw.githubusercontent.com/vercel-labs/writing-guidelines/main/command.md

This is the same issue as #348: the file is mutable and its contents become the agent's instructions, so any change to it (compromised account, bad merge) affects every agent using the skill without review. It also fails if the fetch is blocked.

Proposed fix: same approach as the PR for #348. Bundle a snapshot of command.md in references/, pinned to a commit SHA with a SHA-256 checksum, and regenerate the skill zip if there is one.