docs: turn automation creation into a phased interview, close reliability gaps

[VascoSch92]

Summary

Based on an analysis of 72 real conversations that invoked this skill, cross-referenced with production run data (54k runs) from dev-oss-automation-vm. The skill's guidance was sound but agents routinely skipped the explicit user-facing checkpoints it mandates.

• Interview-style creation flow: Automation Creation Process is now four explicit phases — Discovery (trigger, behavior, LLM-vs-deterministic call stated out loud, access checks, reachability, stakes) → Plan Presentation (shows the plan, ends the turn — never deploys in the same turn it's presented) → Deploy & Verify (dispatches one test run and polls to a terminal state before declaring success) → Report.
• OPENHANDS_HOST moved to the very first thing the agent reads, ahead of everything else.
• Sub-5-minute cron upgraded from a soft suggestion to a hard default to push back on, backed by real production numbers (every-minute automations failed 16–79% of the time vs. 1–31% for 5-minute-or-looser schedules).
• Timeout-vs-cron-interval overlap note added (guards against the concurrent-run races seen in production).
• Retry-with-backoff helper wired into the no-LLM script boilerplate (network fragility is the dominant real-world failure mode).
• Tarball-integrity check added before upload (a corrupted tarball previously uploaded and created the automation fine, then failed silently on the first run).
• Pre-flight health-check pattern added as a recommended custom-script pattern.
• High-stakes-automation confirmation and secret-hygiene-in-prompts guidance folded into the existing Security Considerations section from docs: add Security Considerations section to openhands-automation skill #429 (money-moving/credential-spending/irreversible actions need a restated, specific confirmation — not a bare "yes" — and secrets must never be embedded verbatim in a persisted prompt or script).

Test plan

• npm run build:skills — regenerated skills/index.js to match the updated SKILL.md content
• uv run -p 3.12 --group test pytest tests/test_skills_catalog.py tests/test_sync_extensions.py tests/test_skills_have_readme.py tests/test_skill_plugin_loading.py tests/test_catalog_schema.py tests/test_catalogs.py — 236 passed
• Manual read-through of both edited files for internal consistency (done locally; worth a second pass in review)