fix: address code review findings from cubic-dev-ai

- Fix path traversal regex prefix confusion in perl-security skill
  - Revert v1.4.0 changelog entry (Perl not part of that release)
  - Rename $a/$b to $x/$y to avoid shadowing sort globals
  - Replace return undef with bare return per perlcritic rules

skills/perl-security/SKILL.md

@@ -197,7 +197,7 @@ sub safe_path($base_dir, $user_path) {
         // die "Path does not exist\n";
     my $base_real = realpath($base_dir)
         // die "Base dir does not exist\n";
-    die "Path traversal blocked\n" unless $real =~ /^\Q$base_real\E/;
+    die "Path traversal blocked\n" unless $real =~ /^\Q$base_real\E\//;
     return $real;
 }
 ```