fix(skills, guard): address PR #704 follow-up review

- Pin Chart.js CDN to 4.4.7 in coral and cartesian example.html so
  vendored decks no longer track the latest jsDelivr major.
- Narrow scripts/guard.ts zhangzara allowlist to a regex that only
  permits skills/html-ppt-zhangzara-*/assets/deck-stage.js, restoring
  the TypeScript-first guard for any other JS under those skill dirs.
- Reconcile slide_count and 'Slides in demo' with actual <section
  class="slide"> counts: broadside 20 -> 16, monochrome 18 -> 16,
  neo-grid-bold 13 -> 12.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/guard.ts

@@ -77,16 +77,23 @@ const residualAllowedPathPrefixes = [
   "skills/hyperframes/scripts/",
   // Vendored upstream html-ppt skill runtime assets (lewislulu/html-ppt-skill).
   "skills/html-ppt/assets/",
-  // Vendored upstream Zara template runtimes — one skill per template, name prefix
-  // `html-ppt-zhangzara-` (zarazhangrui/beautiful-html-templates).
-  "skills/html-ppt-zhangzara-",
   "test-results/",
   "vendor/",
 ];
 
+const residualAllowedPathPatterns: RegExp[] = [
+  // Vendored upstream Zara template runtimes — one skill per template, name prefix
+  // `html-ppt-zhangzara-` (zarazhangrui/beautiful-html-templates). Only the
+  // vendored deck-stage runtime asset is allowlisted; any other JavaScript under
+  // these skill directories must still be converted to TypeScript or explicitly
+  // listed in `residualAllowedExactPaths`.
+  /^skills\/html-ppt-zhangzara-[^/]+\/assets\/deck-stage\.js$/,
+];
+
 function isResidualAllowedPath(repositoryPath: string): boolean {
   if (residualAllowedExactPaths.has(repositoryPath)) return true;
-  return residualAllowedPathPrefixes.some((prefix) => repositoryPath.startsWith(prefix));
+  if (residualAllowedPathPrefixes.some((prefix) => repositoryPath.startsWith(prefix))) return true;
+  return residualAllowedPathPatterns.some((pattern) => pattern.test(repositoryPath));
 }
 
 function isResidualSkippedDirectoryName(directoryName: string): boolean {

skills/html-ppt-zhangzara-broadside/SKILL.md

@@ -41,7 +41,7 @@ breaks the system; stay inside this one.
 - **Scheme:** dark
 - **Formality:** medium-high
 - **Density:** medium
-- **Slides in demo:** 20
+- **Slides in demo:** 16
 
 ## Best for
 

skills/html-ppt-zhangzara-broadside/template.json

@@ -43,7 +43,7 @@
   "scheme": "dark",
   "best_for": "Anything that should land like a broadside newspaper headline: brand manifestos, magazine and cultural pitches, design talks, bilingual EN/CN decks, founder vision statements. Also a striking pick for tech, research, or business decks that want a dramatic single-accent editorial feel.",
   "avoid_for": "Decks that need to feel quiet, warm, or institutionally traditional — the dark canvas with fire-orange accent commits to drama.",
-  "slide_count": 20,
+  "slide_count": 16,
   "navigation": "inline keyboard handler",
   "source": "https://github.com/zarazhangrui/beautiful-html-templates/tree/main/templates/broadside"
 }

skills/html-ppt-zhangzara-cartesian/example.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Cartesian Presentation Template</title>
-    <script src="https://cdn.jsdelivr.net/npm/chart.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.7/dist/chart.umd.min.js"></script>
     <link href="https://fonts.googleapis.com/css2?family=Playfair+Display:ital,wght@0,400;0,600;0,700;1,400&family=Inter:wght@300;400;500;600&display=swap" rel="stylesheet">
     <style>
         * {

skills/html-ppt-zhangzara-coral/example.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Presentation Template</title>
-    <script src="https://cdn.jsdelivr.net/npm/chart.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.7/dist/chart.umd.min.js"></script>
     <style>
         @import url('https://fonts.googleapis.com/css2?family=Bebas+Neue&family=Inter:wght@300;400;600;700&display=swap');
 

skills/html-ppt-zhangzara-monochrome/SKILL.md

@@ -40,7 +40,7 @@ breaks the system; stay inside this one.
 - **Scheme:** light
 - **Formality:** high
 - **Density:** high
-- **Slides in demo:** 18
+- **Slides in demo:** 16
 
 ## Best for
 

skills/html-ppt-zhangzara-monochrome/template.json

@@ -44,7 +44,7 @@
   "scheme": "light",
   "best_for": "Anything that should feel like a hand-typeset ledger: user research synthesis, white papers, longform reports, academic and policy briefs, advisory deliverables, bilingual EN/CN reports. Equally good for tech, design, or brand decks that want their words to be the only thing on the page.",
   "avoid_for": "Decks that need visual personality or color-led storytelling — the all-ink palette is intentionally austere.",
-  "slide_count": 18,
+  "slide_count": 16,
   "navigation": "inline keyboard handler",
   "source": "https://github.com/zarazhangrui/beautiful-html-templates/tree/main/templates/monochrome"
 }

skills/html-ppt-zhangzara-neo-grid-bold/SKILL.md

@@ -42,7 +42,7 @@ breaks the system; stay inside this one.
 - **Scheme:** light
 - **Formality:** medium
 - **Density:** high
-- **Slides in demo:** 13
+- **Slides in demo:** 12
 
 ## Best for
 

skills/html-ppt-zhangzara-neo-grid-bold/template.json

@@ -41,7 +41,7 @@
   "scheme": "light",
   "best_for": "Anything that should feel confident and editorial-graphic: design-led pitches, brand work, founder talks, conference keynotes. Excellent for stat-heavy slides, comparisons, and process flows. Just as strong for tech, research, or finance when the speaker wants to read as design-led rather than corporate.",
   "avoid_for": "Contexts that need to feel quiet, traditional, or warm — the neon-yellow accent and uppercase display commit to a confident editorial voice.",
-  "slide_count": 13,
+  "slide_count": 12,
   "navigation": "deck-stage runtime (arrow keys, space, PgUp/PgDn, Home/End)",
   "source": "https://github.com/zarazhangrui/beautiful-html-templates/tree/main/templates/neo-grid-bold"
 }