fix(skill): scope TrimSpace advice to Make-included vault reads

What

otica-migrate-kube/SKILL.md no longer tells migrators to | strings.TrimSpace every vault read. The advice is now scoped:

• Make-included scalars (envvars.sec / env.mk → -included): keep TrimSpace (a trailing \n breaks Make with missing separator).
• Secret data: payloads (PEM keys, certs, keytabs): render verbatim — never TrimSpace before base64.Encode, or you drop a significant trailing newline and lose byte parity with vault2kube.

Why

Blanket trimming silently corrupts secrets whose trailing newline is significant (PEM requires one per RFC 7468). The breakage is invisible at render time and only surfaces when a workload loads a key/cert missing its final \n. This is the migration-side counterpart to #4 (closed) (vault-read.sh verbatim output).

Changes (docs-only, single file)

1. Gotcha #1 (closed) scoped to -included Make reads + explicit 'never trim Secret payloads' warning.
2. Binary-blob section: 'render verbatim, never TrimSpace before base64.Encode' note.
3. Validate section: byte-parity check (vault-read.sh ... | wc -c vs decoded rendered length).

Verification

• make validate passes.
• The added validation snippet was tested end-to-end: grep 'my-key:' ... | awk '{print $2}' | base64 -d | wc -c correctly returns the stored byte count (a self-review caught and fixed an earlier grep -A1 | tail -1 version that decoded the wrong YAML line).
• Cross-checked sibling migrate skills (otica-migrate, -gke, -docker, -tf): none recommend TrimSpace; gke already renders data: verbatim — no edits needed there.

Closes #5 (closed)

Closes #5 (closed)