skill: setup-cs-stack install-profile flags — full / leaf / careful-only (#556 C) #43

Parent epic: https://github.com/CodeSolutionsLLC/ops-coordination/issues/556 (section C — cs-stack install profiles)
Sibling docs leaf: filed as install-profiles docs (pair with this)

Why

Wire setup-cs-stack so first-run can select full / leaf / careful-only without inventing media skills into the public stack.

In scope

1. skills/setup-cs-stack/SKILL.md — document and implement (or clearly specify) profile flags / steps that install only the packages for:
   • full — setup + careful-mode + investigate + fix-bug + ship-change + verify + review-pr
   • leaf — investigate + fix-bug + verify (+ careful-mode optional)
   • careful-only — careful-mode (+ verify optional)
2. Keep idempotent behavior; no secrets; Grok Bot skill-library destination only.
3. Update confirm / smoke lists in that skill to match the chosen profile.

Out of scope

• Rewriting docs/INSTALL.md profile table (sibling docs leaf)
• Media / fleet-* skills
• Soft pull of starship-*
• Merge

Acceptance

• setup-cs-stack documents how to choose full vs leaf vs careful-only
• Confirm/smoke steps match the selected profile
• No DENY / rival-host / marketplace language
• CI green; poteto; READY to Computer

Paths

• In: skills/setup-cs-stack/SKILL.md (and skills/README.md only if index must mention profiles)
• Out: docs/INSTALL.md (sibling), workflows, templates

Capability

remote-ok