claude-code: read front matter as YAML and refuse a file reference outside the item

A byte-order mark, a flow mapping or a merged key hid a key the line scan
looked for, and @path read any file into every session the item reached
(hq issue 340 review).

modules/claude-code/README.md

@@ -100,7 +100,10 @@ another node. So these tools refuse, and say why and how it is done instead:
 - `claude_code_mcp_register`: the operator sets tool servers in the `mcp_servers` setting the same way;
 - a skill, subagent or command that would run something by itself: a shell line the agent runs when it loads one
   (`` !`…` ``, or a block opened with ```` ```! ````), or `hooks`, `mcpServers`, `permissionMode` or `allowed-tools`
-  in its front matter. A script beside a skill is taken: it runs only when the agent runs it, through the
+  in its front matter. Front matter is read as YAML (after a byte-order mark, flow style and merged keys
+  included); front matter that does not close, does not parse or is not a mapping is refused rather than guessed
+  at. A skill or command referring to a file with `@` that is not one of its own files is refused too: the agent
+  reads it into the prompt. A script beside a skill is taken: it runs only when the agent runs it, through the
   session's own rules.
 
 What was registered before stays: a tool server is still rendered, and may be unregistered; a hook or settings the