Route skill pre-flight through Makefile to avoid hardcoded Python

Codex users hit `python: command not found` on the welcome-flow
pre-flight because SKILL.md called `python tools/kb_freshness.py`
directly. Any hardcoded version (python/python3/python3.12) breaks
for somebody — users have 3.8, 3.10, 3.11, 3.12 in the wild.

Fix: channel all skill-initiated Python calls through `make` targets
so the Makefile's single $(PYTHON) variable (auto-detected venv >
3.12 > 3.11 > 3.10 > python3) is the only place Python resolution
lives.

- Makefile: add `kb-check` target emitting JSON for the skill pre-flight
- SKILL.md + .agents/skills/.../SKILL.md: call `make kb-check` and
  `make freshness-refresh` instead of bare `python tools/...`
- CLAUDE.md: same fix in the Welcome Flow instructions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Makefile

@@ -92,5 +92,8 @@ sync-skill: ## Regenerate .agents/skills/oci-deal-accelerator/SKILL.md from root
 freshness: ## Report stale KB files (informational, never fails)
 	-@$(PYTHON) tools/kb_freshness.py --check
 
+kb-check: ## KB freshness JSON (used by skill welcome-flow pre-flight)
+	@$(PYTHON) tools/kb_freshness.py --check --json
+
 freshness-refresh: ## Run refresh tools for stale KB files that support automation
 	@$(PYTHON) tools/kb_freshness.py --auto-refresh