Tightening the codebase-onboarding skill

A teammate just shared a personal skill called codebase-onboarding to help new hires get oriented in a service repo, and it's already installed at ~/.claude/skills/codebase-onboarding/SKILL.md.

There are two problems with it that waste context every time the skill loads:

1. It leaves Claude with full edit and write permission (the skill is supposed to be read-only. New hires shouldn't get an agent that modifies code while they're just trying to look around).
2. The body is huge because the entire architecture reference was pasted directly into SKILL.md instead of split into a separate file.

In this exercise you'll fix both: add an allowed-tools allowlist that restricts the skill to read-only discovery, and apply progressive disclosure by moving the architecture reference into its own file under references/