fix(security): remove curl|bash, enforce HTTPS-only downloads

- Replace all curl|bash install suggestions with brew/npm
- downloadFile: HTTPS-only, reject http:// URLs
- downloadFile: add redirect limit (max 5)
- Remove unused http import from md-to-html scripts
- Add Security Guidelines section to CLAUDE.md
- Update SKILL.md profile dir references

skills/baoyu-post-to-wechat/scripts/check-permissions.ts

@@ -181,7 +181,7 @@ async function checkBun(): Promise<void> {
   if (result.status === 0) {
     log('Bun runtime', true, `v${result.stdout?.toString().trim()}`);
   } else {
-    log('Bun runtime', false, 'Cannot run bun. Install: curl -fsSL https://bun.sh/install | bash');
+    log('Bun runtime', false, 'Cannot run bun. Install: brew install oven-sh/bun/bun (macOS) or npm install -g bun');
   }
 }