fix: correct Tree Ring skill guidance

[TerminallyLazy]

Summary

Correct the existing Tree Ring Memory skill guidance after its earlier merge:

• align the license and README credit with the upstream MIT license
• replace unsupported recall and evidence flags with current CLI syntax
• document project-local installation, initialization, and update flows
• pin and verify the installer before execution, with explicit approval before download and again before running it

Type of change

• Skill PR
• Docs PR
• Automated Skill Review (awaiting this PR workflow)

Contributor checklist

• I read the contributor standards and maintenance documentation.
• Skill metadata and trigger/limitation guidance are valid.
• Risk remains declared safe.
• Security documentation checks and manual review were completed.
• This is a source-only change; generated catalog artifacts are not included.
• README credit and license now match the upstream source.
• Maintainers may edit this branch.

Validation

• npm run chain
• npm run check:warning-budget
• npm run validate:references
• npm run security:docs
• npm run test (113 groups passed; network integrations skipped by repository default)
• npm run check:readme-credits -- --base origin/main --head HEAD
• npm run pr:evidence -- --base origin/main --head HEAD --output /tmp/tree-ring-pr-evidence.json --json (blocking: false)

Follow-up to the Tree Ring Memory entry merged in #791.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9c6fbd65d9

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Use the project-local executable in subsequent commands

When the recommended --project installation is used on a machine without a global Tree Ring installation, the executable is available only as .tree-ring/bin/tree-ring, as this paragraph itself notes. However, the update command immediately below and every recall, remember, and evidence example still invoke bare tree-ring, so following the documented flow produces command not found. Define the executable once, add the local directory to PATH, or use the project-local path consistently throughout the remaining examples.

AGENTS.md reference: AGENTS.md:L52-L54

Useful? React with 👍 / 👎.

[TerminallyLazy]

Maintainer-ready follow-up: current head dcc5cc9 is clean and every reported CI/security/source-validation check is green. The Tree Ring guidance now uses the verified bootstrap/update path and project-local tree-ring init flow. No further code review findings are outstanding; the remaining gate is the repository’s required human review.