harness: fleet-wide functional-error + correction + friction logging

Add .claude/scripts/log-skill-error.sh — the canonical agent error log helper
(writes errorlog.md in DATE | MACHINE | skill | [type] error format, soft-fails).
Three categories: execution failures (default), user corrections (--correction),
and preventable self-inflicted friction (--friction; cite ref= when it repeats a
documented gotcha). Goal: stop paying tokens twice for the same avoidable mistake.

- CLAUDE.md: make logging mandatory for all skills + corrections + friction.
- skill-creator: new skills must wire in the helper (guidance + checklist).
- Retrofit every skill script's genuine failure branches to call the helper
  (b2/bitdefender/mailprotector/packetdial/coord python CLIs; remediation-tool
  + onboard365 bash; vault, rmm-auth, post-bot-alert, agy, grok, 1password,
  run-onboarding-diagnostic). Handled conditions + self-tests left alone.
- errorlog.md: broaden header to cover skills + harness + corrections; seed this
  session's corrections (INKY, Mail.Send token-audience, omnibox-strictness) and
  friction (git-bash /tmp, env-persistence, argv-limit, PowerShell var-case).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/scripts/vault.sh

@@ -16,9 +16,12 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 CLAUDETOOLS_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 IDENTITY_FILE="$CLAUDETOOLS_ROOT/.claude/identity.json"
 
+_logerr() { bash "$CLAUDETOOLS_ROOT/.claude/scripts/log-skill-error.sh" "vault" "$@" >/dev/null 2>&1 || true; }
+
 if [[ ! -f "$IDENTITY_FILE" ]]; then
     echo "[ERROR] .claude/identity.json not found at $IDENTITY_FILE" >&2
     echo "        Run onboarding to create it, or add vault_path manually." >&2
+    _logerr "identity.json not found; vault read cannot resolve vault_path" --context "path=$IDENTITY_FILE"
     exit 1
 fi
 
@@ -40,6 +43,7 @@ fi
 if [[ -z "$VAULT_ROOT" ]]; then
     echo "[ERROR] vault_path not set in $IDENTITY_FILE" >&2
     echo "        Add: \"vault_path\": \"/path/to/vault\"" >&2
+    _logerr "vault_path not set in identity.json; vault read failed" --context "path=$IDENTITY_FILE"
     exit 1
 fi
 
@@ -48,6 +52,7 @@ REAL_VAULT_SH="$VAULT_ROOT/scripts/vault.sh"
 if [[ ! -f "$REAL_VAULT_SH" ]]; then
     echo "[ERROR] vault.sh not found at $REAL_VAULT_SH" >&2
     echo "        Check vault_path in $IDENTITY_FILE" >&2
+    _logerr "real vault.sh not found at resolved vault_path; vault read failed" --context "path=$REAL_VAULT_SH"
     exit 1
 fi