docs: verify public install and refresh launch metrics

[JNHFlow21]

Summary

• make the verified project-local npx skills route canonical in both README languages
• document the installer telemetry opt-out separately from the Skill's no-telemetry boundary
• keep Codex's built-in Skill Installer as the alternative route
• refresh the dated aggregate GitHub Traffic snapshot after publication

Evidence

• clean temporary project install with skills@1.5.22: installed .agents/skills/open-source-launch/SKILL.md
• installed audit helper present and executable
• python3 -m unittest discover -s skills/open-source-launch/tests -v — 9 passed
• README audit — score 100, 0 findings
• actionlint — passed
• Gitleaks current-tree scan — 0 findings
• git diff --check — passed

Boundaries

• install remains project-local by default
• DISABLE_TELEMETRY=1 applies to the third-party installer CLI; the Skill itself includes no telemetry
• Traffic values remain a dated rolling 14-day owner snapshot, not lifetime analytics