harness: fleet-wide functional-error + correction + friction logging

Add .claude/scripts/log-skill-error.sh — the canonical agent error log helper
(writes errorlog.md in DATE | MACHINE | skill | [type] error format, soft-fails).
Three categories: execution failures (default), user corrections (--correction),
and preventable self-inflicted friction (--friction; cite ref= when it repeats a
documented gotcha). Goal: stop paying tokens twice for the same avoidable mistake.

- CLAUDE.md: make logging mandatory for all skills + corrections + friction.
- skill-creator: new skills must wire in the helper (guidance + checklist).
- Retrofit every skill script's genuine failure branches to call the helper
  (b2/bitdefender/mailprotector/packetdial/coord python CLIs; remediation-tool
  + onboard365 bash; vault, rmm-auth, post-bot-alert, agy, grok, 1password,
  run-onboarding-diagnostic). Handled conditions + self-tests left alone.
- errorlog.md: broaden header to cover skills + harness + corrections; seed this
  session's corrections (INKY, Mail.Send token-audience, omnibox-strictness) and
  friction (git-bash /tmp, env-persistence, argv-limit, PowerShell var-case).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/skills/coord/scripts/coord.py

@@ -21,7 +21,25 @@ Usage:
   coord.py lock release <id>
   coord.py lock list [--project KEY]
 """
-import sys, os, json, argparse, urllib.request, urllib.error, urllib.parse
+import sys, os, json, argparse, subprocess, urllib.request, urllib.error, urllib.parse
+
+
+def _log_skill_error(skill, msg, context=""):
+    """Soft-fail: append a functional-error entry to errorlog.md (never throws)."""
+    try:
+        root = os.environ.get("CLAUDETOOLS_ROOT") or os.path.abspath(
+            os.path.join(os.path.dirname(__file__), "..", "..", "..", "..")
+        )
+        h = os.path.join(root, ".claude", "scripts", "log-skill-error.sh")
+        if not os.path.exists(h):
+            return
+        a = ["bash", h, skill, msg]
+        if context:
+            a += ["--context", context]
+        subprocess.run(a, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+                       timeout=10)
+    except Exception:
+        pass
 
 
 def find_identity():
@@ -73,6 +91,10 @@ def call(method, path, body=None, query=None):
 def die(st, resp, ok=(200, 201)):
     if st not in ok:
         print(f"[coord] ERROR HTTP {st}: {json.dumps(resp)[:500]}", file=sys.stderr)
+        _log_skill_error(
+            "coord", f"coord API call failed (HTTP {st})",
+            context=f"http={st} cmd={' '.join(sys.argv[1:3])} resp={json.dumps(resp)[:80]}",
+        )
         sys.exit(1)