fix: guide agent to a real public link instead of dead-ending on apps__create_app

Diagnosed via production session logs (RDS + shared goose PG) that some
users' page-generation attempts drifted: the agent used apps__create_app
(no public URL) then fabricated a placeholder domain when asked for a
link, and separately burned many turns scraping unreachable/anti-bot
search engines. Steer both flows toward the already-working path instead
of banning tools outright:

- apps__create_app is fine for designing/previewing a page, but the
  agent must still write_file the result into public/*.html per the
  static-page-publish skill and return a link built from the real
  public URL template (no invented domains)
- for real-world lookups, load_skill('web') first and prefer
  Bing/360 over retrying google.com or hammering anti-bot sites

Also folds in generate_docx guidance for Word-download attachments
(sandbox-fs tool) that landed in the same files during this pass.

Co-Authored-By: Claude <noreply@anthropic.com>

skills/web/SKILL.md

@@ -26,3 +26,9 @@ description: 网页抓取与搜索技能：访问网页、查阅文档、搜索
 2. `extract_text: true`（默认）获取可读文本，`false` 获取原始 HTML
 3. 不要访问不明来源的链接，向用户确认后再访问
 4. 官方文档优先于第三方博客
+
+## 国内网络环境（建议）
+
+- 生产环境访问不了 `google.com`，优先用本技能的 `web_search`（DuckDuckGo）/`fetch_url`，避免直接拿 `computercontroller__web_scrape` 抓 Google 页面来回重试
+- `web_search` 连续几次没有可用结果时，改用 `fetch_url` 直接访问 `https://cn.bing.com/search?q=...` 或 `https://www.so.com/s?q=...` 这类国内可达的搜索入口
+- 百度/知乎/大众点评等站点有反爬拦截，遇到跳转或空结果就换个搜索源，不必在同一个来源上反复硬抓