msk-operations: address PR #19 review feedback

- Add explicit read-only boundary to SKILL.md Critical Warnings
- Reframe update-broker-storage / create-configuration / reboot-broker
  recipes with operator-actor language (recommend, do not execute)
- Guard the reboot-broker game-day exercise in maintenance-operations.md
  with a UnderReplicatedPartitions=0 precondition and scheduled-window
  framing
- Add EnableMskOperations block to cloudformation/devops-agent-skill-policies.yaml
  granting kafka:GetBootstrapBrokers (the one IAM action not covered by
  AIDevOpsAgentAccessPolicy)
- Rename README agent-type label "On-demand" -> "Chat tasks" to match
  frontmatter and other skills; note kafka:GetBootstrapBrokers as the
  single AIDevOpsAgentAccessPolicy exception
- Bump skill version to 1.0.1