Harden OCI IoT skill CLI, publish, and validation workflows

[wsanders00]

Problem

The OCI IoT Platform skill has several correctness and operational-safety gaps:

• scripts/twin_tools.py does not consistently unwrap standard OCI CLI response shapes.
• scripts/derive_domain_context.sh cannot select the region needed for its initial domain lookup.
• references/data-access.md omits the required 20250531 Data API version segment.
• templates/publish-curl.template.sh places Basic authentication material in curl arguments and does not fail on HTTP error responses.
• references/release-validation.md contains stale validation paths.
• SKILL.md does not use the current ## Sources convention.

Proposed Changes

• Normalize wrapped and unwrapped OCI CLI records without duplicates.
• Add and document explicit --region forwarding.
• Correct the versioned Data API base path.
• Send the Basic authorization header to curl through standard input.
• Make HTTP 4xx and 5xx responses fail while preserving the response body.
• Correct release commands and source formatting.
• Add deterministic tests using mocked OCI and curl commands.

Acceptance Criteria

• Supported OCI CLI response shapes produce equivalent records.
• Both domain bootstrap calls receive the supplied region.
• Data API URLs include /20250531 before collection paths.
• Publish credentials do not appear in curl arguments or temporary files.
• HTTP publish errors return a nonzero status.
• Smoke and redaction checks pass.
• Optional MCP and connectivity-topology guidance remain unchanged.

No live OCI, ORDS, create, update, delete, or publish operations are required.