Add budgeted live ECNU validation and harden the skill

[JJasonSun]

Summary

• add a serial, sanitized, credit-budgeted ECNU live-validation runner
• record dated API deviations without overriding the documented contract
• harden auth gating, retry/redirect behavior, response bounds, SSRF checks, media validation, and secret scanning
• update workflows, examples, models, API references, and CI dependency coverage
• document targeted revalidation after future ECNU platform updates; announcements trigger review but do not resolve deviations without fresh evidence

Live evidence

• tested 61 distinct cases on 2026-08-23
• 44 pass, 14 mismatch, 1 inconclusive, 2 skipped
• conservative estimated consumption: 48.96004 Credits under the 50-Credit ceiling
• no API key, generated output, reasoning text, media, or one-time URL is committed

Validation

• python scripts/validate_skill.py
• python -m unittest discover -s tests -v — 61 passed locally
• python -m compileall scripts tests
• uvx --from skills-ref agentskills validate "$PWD"
• git diff --check
• tracked secret and literal Bearer scans

Billable revalidation remains opt-in and requires fresh account-owner authorization.