chore: resolve minor issues across config

- Add when_to_use to worker-protocol, qa-checklist, and project skills
- architect: allow Write for plan files, add NotebookEdit to disallowedTools
- documenter: remove redundant permissionMode (not enforced at runtime)
- orchestrate: split blocked/escalate into explicit routing rows,
  distinguish architect plan_result blocked from generic blocked

skills/qa-checklist/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: qa-checklist
 description: Self-validation checklist. All workers run this against their own output before returning results.
+when_to_use: Loaded by all agents that produce output envelopes. Run before returning results to validate factual accuracy, scope, security, and schema compliance.
 ---
 
 ## Self-QA checklist