refactor(skills): single-pass escapeXML, drop no-op Sprintf

[corporatepiyush]

📝 Description

Two tiny cleanups in pkg/skills/loader.go:

1. escapeXML made three sequential strings.ReplaceAll passes (three allocations). Replaced with a package-level strings.NewReplacer (single pass, built once). Byte-identical: it still escapes only &, <, > (not "/'), and single-pass replacement does not re-escape the & introduced by the </> replacements. Pinned by the new TestEscapeXMLGolden.
2. fmt.Sprintf(" <skill>") in BuildSkillsSummary has no format directives → replaced with the plain string literal " <skill>".

🗣️ Type of Change

• 🐞 Bug fix
• ✨ New feature
• 📖 Documentation update
• ⚡ Code refactoring (no functional changes, no api changes)

🤖 AI Code Generation

• 🤖 Fully AI-generated
• 🛠️ Mostly AI-generated (AI draft, Human verified/modified)
• 👨‍💻 Mostly Human-written

🔗 Related Issue

N/A — self-contained cleanup.

📚 Technical Context

• Reasoning: strings.NewReplacer builds its matcher once and replaces in a single pass; the old chain walked the string three times with three intermediate allocations. escapeXML runs for every skill name/description/path in the skills summary that is injected into the system prompt.

Benchmark (go1.26, darwin/arm64, -benchmem):

target	before	after	result
escapeXML	1.64µs · 2944 B · 3 allocs	0.90µs · 2048 B · 2 allocs	1.8× faster, −30% mem

🧪 Test Environment

• Hardware: Apple Silicon (arm64)
• OS: macOS 15
• Model/Provider: N/A — pure refactor, no LLM calls exercised
• Channels: N/A

Verification: go vet + go test ./pkg/skills/ pass (incl. new TestEscapeXMLGolden); gofmt clean.

☑️ Checklist

• My code follows the style of this project.
• I have performed a self-review of my own changes.
• I have updated the documentation accordingly. (N/A — internal helper.)

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}