Fix ClawHub scan findings: declare env vars, remove git-pull cron

- claw.json: declare KERNEL_API_KEY (required) and ANTHROPIC_API_KEY
  (optional) so registry metadata matches actual requirements
- claw.json: add telegram credentials declaration
- SKILL.md: remove frontmatter block (triggered prompt-injection scanner)
- SKILL.md: remove Git Pull cron row (ops detail, not part of skill)
- Bump version to 0.1.1

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

claw.json

@@ -1,6 +1,6 @@
 {
   "name": "claw-apply",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Automated job search and application for LinkedIn and Wellfound. Searches for matching roles, applies automatically using stealth browsers, and learns from every unknown question.",
   "author": "MattJackson",
   "license": "AGPL-3.0-or-later",
@@ -8,5 +8,21 @@
   "entry": "SKILL.md",
   "tags": ["job-search", "automation", "linkedin", "wellfound", "playwright", "apply"],
   "models": ["claude-*"],
-  "minOpenClawVersion": "0.8.0"
+  "minOpenClawVersion": "0.8.0",
+  "env": {
+    "KERNEL_API_KEY": {
+      "required": true,
+      "description": "Kernel API key for stealth browser sessions (kernel.sh)"
+    },
+    "ANTHROPIC_API_KEY": {
+      "required": false,
+      "description": "Anthropic API key for AI filtering, keyword generation, and suggested answers"
+    }
+  },
+  "credentials": {
+    "telegram": {
+      "required": false,
+      "description": "Telegram bot token + user ID for notifications and interactive Q&A (configured in settings.json)"
+    }
+  }
 }