Sync clarion-setup: defensive service-registration verification

[jingerzz]

Syncs `External/clarion-setup/SKILL.md` to upstream `jingerzz/clarion-intelligence-system@4236cdd` (PR #20).

What this addresses

A new Zo user's Clarion install (documented in gist `f074a7555097546b5f582bdf07234a4f`) ended with a "successfully registered" `sec-indexer` service that:

• had a trailing XML-tag artifact appended to its entrypoint (`sec-indexer</`)
• had `CLARION_DATA_ROOT` inlined into the entrypoint shell-string instead of staying as a separate env var

The agent reported "setup complete" because `register_user_service` returned success and `sec-indexer --help` worked. Neither proves the service actually runs. The supervisor cannot execute `sec-indexer</`.

Root cause and where the fix lives

The model on that Zo serialized `env_vars` as a stringified JSON instead of a JSON object, causing escape-handling complexity and multiple `runner stopped` failures. The eventual workaround inlined env vars into the entrypoint shell-string — fragile, and the entrypoint also bled an XML stop-token artifact.

Zo engineering confirmed (paraphrased) that:

• The platform's escape-handling is correct; auto-correcting malformed model input would be wrong
• Validating shell-command syntax in the platform isn't appropriate ("there's not one syntax that's really valid we ought to parse")
• The agent should check service startup

Translation: prevention and verification belong in the bootstrap's SKILL.md. This sync brings that fix into the registry.

Changes (docs-only, +36/-4 lines)

Step 4 — sharpen env_vars guidance. New env_vars formatting (critical — common failure mode) callout with correct-vs-wrong examples:

```json
// correct
{"ZO_API_KEY": "$ZO_API_KEY", "CLARION_DATA_ROOT": "/home/workspace/clarion"}

// WRONG (stringified, requires escapes)
"{\"ZO_API_KEY\": \"$ZO_API_KEY\", ...}"
```

Tells the agent that escape-sequences-required means re-form the call.

Step 5 — replace weak `--help` check with real service-status verification. Previous Step 5 just ran `sec-indexer --help` and called the install done. New Step 5 runs `service_doctor sec-indexer`, requires `RUNNING` with non-zero uptime, names the two known failure modes (trailing entrypoint chars; missing/inlined env_vars), provides log paths, and adds an explicit "do not report setup complete until status is RUNNING" rule. The `--help` check is preserved at the bottom as a labeled secondary sanity check.

Validation

`bun validate` — clean on `clarion-setup` (the 15 pre-existing warnings on other skills are untouched).

Footprint

Single file: `External/clarion-setup/SKILL.md`. No code, no schema, no other skills affected.

After merge, the SKILL.md change is what the registry serves to new users running install the clarion-setup skill. Frontmatter is unchanged, so no manifest regen is needed.