[k4spi4n]

Several reference examples either fail as written or imply behavior that the underlying runtime does not support. This corrects eight skills and adds primary-source references beside the affected guidance.

• SSTI: resolve Velocity's Scanner constructor using the declared InputStream parameter type; explain that FreeMarker's ObjectConstructor still requires resolver permission and cannot bypass a disabled new built-in.
• PHP deserialization: scope automatic PHAR metadata loading to PHP before 8.0 and distinguish explicit metadata calls and their deserialization options on PHP 8+.
• GraphQL: explain that Apollo Sandbox requires server-side introspection, distinguish incomplete custom filters from Apollo's built-in restriction, and update the cheatsheet.
• JWT: use an unknown-extension critical-header probe, state the signing prerequisite, and distinguish header validation from payload expiry.
• Zigbee: correct the leaked Touchlink master key in both references and distinguish master, transport, and network keys.
• Bluesky: distinguish the current DID document from operation history, document the different log response shapes, and qualify alias ownership claims.
• WAF bypass: attribute SQL/JSON syntax evasion to Team82's 2022 research, replace the MongoDB-style example with SQL predicates, and distinguish the unrelated Imperva CVE-2023-50969.

Added an Unreleased changelog entry.

Validation:

• git diff --check passed.
• Checked unchanged metadata and balanced code fences in all eight modified skills, plus the new SSTI anchor. Two existing skills retain their legacy metadata format; manifest inputs are unchanged.
• Executed the corrected Velocity constructor/output-reading expression in Velocity 1.7 with ClassTool 2.0 and a harmless multiline stream fixture.
• Checked JWT critical-header rejection, payload-expiry enforcement when critical-header validation alone is disabled, and signature rejection after header mutation with PyJWT.
• Cross-checked PHP, FreeMarker, Apollo, SQL/JSON, PLC, and Touchlink claims against the primary documentation/research linked in the changes. Those runtimes and protocols were not exercised against live targets.

The affected guidance was traced through the repository history, including 4c7fcfd, 1885f44, 4e214145, and c7b211b.