feat: add --raw flag to github-app-token and clean up docs

- Add --raw flag that prints only the token value (no export wrapper),
  making GH_TOKEN=$(./generate_token.sh --raw) the recommended pattern
  for AI agents and CI/CD.
- Clean up die() to only write to stderr (remove eval-safe stdout hack).
- Fix SKILL.md: correct step numbering, remove unused grep prerequisite,
  replace placeholder paths, lead with --raw usage, move eval to legacy.
- Update CLAUDE.md to reflect new --raw pattern.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

CLAUDE.md

@@ -14,12 +14,12 @@ Each skill follows this convention:
 
 ## Current Skills
 
-- **`github-app-token`** — Generates short-lived GitHub App installation access tokens. Requires `GITHUB_APP_ID`, `GITHUB_APP_INSTALLATION_ID`, and `GITHUB_APP_PEM_FILE` env vars. The script outputs an `export GH_TOKEN=...` command meant to be `eval`'d by the caller.
+- **`github-app-token`** — Generates short-lived GitHub App installation access tokens. Requires `GITHUB_APP_ID`, `GITHUB_APP_INSTALLATION_ID`, and `GITHUB_APP_PEM_FILE` env vars. Use `--raw` flag to get the token value directly (recommended for agents), or omit for legacy `eval`-based `export GH_TOKEN=...` output.
 
 ## Key Patterns
 
 - Scripts are pure bash with no external dependencies beyond standard Unix tools (`openssl`, `curl`, `jq`).
-- The `eval` output pattern: scripts print shell commands to stdout (e.g., `export VAR="value"`) so callers can `eval` the output to set variables in their environment.
+- The `--raw` output pattern (preferred): scripts with `--raw` print only the value to stdout for easy `$(...)` capture. The legacy `eval` pattern (no flag) prints shell commands like `export VAR="value"` for backward compatibility.
 - The `die()` function prints errors to stderr and exits non-zero.
 
 ## No Build/Test/Lint System