This PR brings the bionemo-agent-toolkit skills into the NVIDIA/skills aggregation setup and gets everything passing the NVCARPS validation pipeline (Tier 1 security, Tier 2 dedup, Tier 3 evals).

Most of the work was building out the catalog and then chasing down the CI findings tier by tier. Rough breakdown:
Skills added

• NIM skills: boltz2, diffdock, evo2, genmol, molmim, msa-search, openfold2, openfold3, proteinmpnn, rfdiffusion, plus the drug-discovery and msa structure meta-skills.
• Library skills: parabricks (with per-tool references), nvMolKit, cuequivariance.
• Open-models: the kermt and proteina-complexa families.
• The generative-protein-binder-design workflow (complexa + protein binder design), including its scripts and vendored science-skills.

Catalog:

• Added the components.d/, plugins.d/, catalog-exceptions.yml, and skills.sh.json wiring for the aggregator.
• Reworked scripts/plugin_sync.py so the generated plugins/bionemo-agent-toolkit/ payload stays byte-for-byte in sync with source. Had to adapt it to keep evals/ in the
  payload once Tier 3 started requiring the eval datasets.
• Nightly sync workflow + an orphan-pruner script under .github/.

Evals

• Hosted-endpoint eval datasets for all the NIM/meta skills, plus a proteinmpnn Harbor example.

CI fixes

• Tier 1 security: switched every os.environ["NGC_API_KEY"] to os.getenv(...) - the scanner flags the subscript form as credential harvesting, while os.getenv is fine
  (this is what evo2 was already doing). Also cleaned up a handful of one-offs: a | sudo install, an rm -rf in a doc table, a stray "Hydra" the YARA rule tripped on, a
  .env credential-access flag, some dead links, and a description warning about data being sent to hosted endpoints.
• Tier 2 dedup: trimmed the duplicated blocks out of the NIM SKILL.md files (they were repeating what's in references/), split the shared parabricks performance notes
  into their own file, and pulled the duplicated boltz2 endpoint helper into boltz2_endpoint.py.
• Naming/structure: kebab-cased the workflow dir and cuequivariance, and declassified the vendored science skills so they don't look like nested skill roots.