Chromium launch was fragile: the documented `chromium ... & sleep 5` assumed
`chromium` was on PATH, but on macOS the binary lives inside an .app bundle
and the command silently failed (&>/dev/null swallowed the error). sleep 5
was not a readiness check, getWsUrl() had zero retries, and the health check
depended on python3.

Changes:
- Add scripts/ensure-chromium.js: cross-platform binary discovery (macOS
  .app bundles, Linux PATH, Windows install dirs), stale-SingletonLock
  cleanup, spawn with CDP, poll /json/version until ready (30s), and a
  diagnostic stderr-log tail on timeout. Pure node http, no python3.
  Supports config.chromium.{cdpPort,headless,executablePath,userDataDir}.
- harvest.js: auto-call ensureChromium before browser-source fetch (no-op
  if already running). Sources needing login can set chromium.userDataDir
  to a logged-in profile; auto-launches then carry the cookies.
- fetcher-browser.js: getWsUrl() now retries (6x500ms) and reads the CDP
  port from config (env > config.chromium.cdpPort > 9222).
- config-template.json: add optional chromium block.
- SKILL.md / README.md: replace the manual launch command with the
  auto-launch explanation; add --help docs and dedicated-profile guidance.

Also clean up the skill flow to cut a 16-step run down to ~4:
- All commands now use the `scripts/` prefix (bare `node harvest.js` failed
  with MODULE_NOT_FOUND — 5x in the trace).
- First-Run Setup becomes a single pre-flight gate: print OK -> skip to
  Workflow, don't re-check vault/source/config mid-task.
- Workflow adds a "stay lean" note: if the user named a source, don't run
  source-manage.js list; the archive flow is exactly 3 script calls.