Switch embedded weather skill to keyless wttr.in endpoint

[zaidoskate]

Type of Change

• Bug fix

Description

The embedded weather skill was dead on arrival: it only allowed egress to api.openweathermap.org and api.weatherapi.com, both of which require an API key, while the skill declared no env.required key. On top of that, the tool sections were prose-only with no runnable command — nothing was actually wired to make a request.

This switches the skill to wttr.in, which needs no API key for reasonable free traffic, and adds runnable curl commands to both tools.

General Checklist

• Tests pass for affected modules (go test ./...)
• Code is formatted (gofmt -w)
• Linter passes (golangci-lint run)
• go vet reports no issues
• No new egress domains added without justification

Skill Contribution Checklist

• forge skills validate passes with no errors
• forge skills audit reports no policy violations
• egress_domains lists every domain the skill contacts
• No secrets or credentials are hardcoded
• SKILL.md includes ## Tool: sections with input/output tables
• Skill tested locally with expected input/output

Related Issues

Closes #349

Notes

• forge skills validate expects a project-level forge.yaml/skills/ layout rather than the embedded skills path, so I validated via forge skills audit --embedded and --dir instead — both report weather at low risk (3/100) with no violations.
• Corrected the forecast range from "1-7" to "1-3" days in SKILL.md, since wttr.in's free JSON endpoint caps at 3 days (today + 2).
• Side note: while testing with forge skills audit, I noticed egress domains aren't reported correctly for weather (and pre-existing, for github too, which I didn't touch) — seems unrelated to this fix. Happy to open a separate issue if useful.