Namespace requires-secrets as vendor extension (x-requires-secrets)

[bug-ops]

Context

Audit finding AUDIT-009 from spec conformance review.

Problem

requires-secrets is a Zeph extension not in the Agent Skills spec. It uses spec-like naming without vendor prefix, risking collision if the spec adds a similar field.

Proposed Fix

Rename to x-requires-secrets per JSON Schema vendor extension convention. Support both forms during transition period with deprecation warning for the old name.

Breaking change — acceptable pre-1.0 but needs CHANGELOG entry.

References

• Spec: https://agentskills.io/specification.md#metadata-field
• Files: crates/zeph-skills/src/loader.rs
• Parent audit: Align SKILL.md parser with agentskills.io specification #686