docs: cover post-4.8.0 changes across README, admin guide, skills, CHANGELOG

[pjdoland]

Summary

The docs were getting behind: v4.8.0 was tagged but never got a CHANGELOG entry, and the three big Settings tabs (Skills as a top-level tab, Claude MCP, Claude Plugins) plus the new launcher tiles, Copilot model discovery, terminal drag-drop, and assorted admin-policy knobs that have merged since were under-documented across README, the admin guide, and `docs/skills.md`. This PR is a catch-up pass, not a comprehensive refresh.

I think we should do another doc update before 5.0 to revisit voice, deduplication between README and the admin guide, and the Failure-modes / Version-matrix tables more holistically. But I didn't want things to get too far behind in the meantime, so this PR ships the load-bearing corrections now and flags the rest as follow-up.

What this PR does

CHANGELOG.md

• Backfills the missing `[4.8.0]` entry from the `v4.7.0..v4.8.0` merge range.
• Adds an `[Unreleased]` section covering the post-4.8.0 work: three new Settings tabs and their management policies, four new launcher tiles, dynamic GitHub Copilot model discovery, terminal drag-drop with its upload-staging tunables, real progress feedback for long Claude tasks, and the fix-only entries from the same window.

README.md

• New `Claude MCP Servers` and `Claude Plugins` sections.
• Glossary entries for `Skill` and `Claude plugin` so the new sections read cold.
• Expanded launcher-tile subsection covering opencode, Pi, GitHub Copilot CLI, and Codex.
• Skills section reworded so it's clear the tab is now visible in any mode and that the manifest is admin-only.

docs/admin-guide.md

• Env-var table rows for the four new CLI path overrides, the upload tunables, and the skill archive cap.
• HTTP API table rows for `/claude-mcp/` and `/plugins/`, with the gates named correctly.
• New `Disabling terminal drag-drop file attach` section under "Restricting features" with the trust-model note (this is the most security-relevant addition in the release and previously had no dedicated section).
• Four new Failure-modes rows: plugin install failure, marketplace fetch from GHE, Copilot model-list failure, upload 413.
• Version matrix extended through 4.8.x.
• Security-model bullet (3) refreshed to cite `allow_github_skill_import` / `allow_github_plugin_import` instead of saying "network-layer only."

docs/skills.md

• First paragraph updated to reflect the top-level tab.
• Stale "no flag exists" paragraph replaced with the real `allow_github_skill_import` / `NBI_ALLOW_GITHUB_SKILL_IMPORT` flag plus a pointer to `skills_management_policy` for stricter posture.

Review process

Four persona agents (technical writing, accuracy / code-truth, end-user, operator) reviewed the changes before commit. Fix-before-merge findings applied:

• `claude_plugins_management_policy` corrected throughout (I'd written `plugins_management_policy` in a couple of places).
• `/plugins//` is POST and DELETE, not GET/DELETE+PATCH (enable/disable goes through POST with an `action` body).
• Codex tile attribution split out: PR feat(launcher): add tiles for opencode, Pi, and GitHub Copilot CLI #268 covers opencode, Pi, and GitHub Copilot CLI; Codex was a separate commit.
• Glossary entries for Skill and Claude plugin added so a first-time reader can parse the new sections.

Risks / follow-ups

No code changes; doc-only. Cross-checked against `extension.py`, `util.py`, and `skill_github_import.py` for the env vars, traitlets, HTTP routes, and defaults.

What I'd still revisit before 5.0:

• The env-var table in the admin guide claims to be "the full surface" but several pre-4.8.0 Claude-agent timeout env vars (`NBI_CLAUDE_AGENT_*`) and the MCP timeout aren't listed. Out of scope for this PR but worth a dedicated pass.
• README and admin guide duplicate the upload-tunables description; one of them should become the source of truth and the other should link.
• A few CHANGELOG bullets are short and could grow more detail with help from the original authors.

Testing

Doc-only. Verified:

• `pytest tests/` and `jlpm tsc` still pass with no code touched.
• All cross-doc anchors (`#disabling-the-skills-tab`, `#disabling-the-plugins-tab`, `#disabling-user-initiated-github-imports`, `#github-auth-for-marketplace-add`) resolve to real headings.
• No em dashes in the added prose.