feat(skills,cli): sandbox avoir (credit note) + arcodange sandbox CLI group

- dolibarr-sandbox-write/scripts/creditnote-create.sh: create a customer avoir
  (credit note) — a customer invoice type=2 referencing source_invoice
  (fk_facture_source); amounts negative, validates to an AVC… ref. Proven live.
- bin/arcodange: new `sandbox` command group wiring the write scripts —
  `arcodange sandbox {thirdparty|invoice|payment|creditnote|write}` (JSON on
  stdin). Header + usage updated to note the CLI now does host-guarded sandbox
  writes (still read-only on prod).
- SKILL.md: avoir workflow + CLI notes.

Verified end-to-end through the CLI: thirdparty -> invoice (FAC…) -> avoir
(AVC…, total_ttc -240, fk_facture_source set); host-guard intact via the CLI.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/skills/dolibarr-sandbox-write/SKILL.md

@@ -104,6 +104,17 @@ payments require an explicit `amount`. `account_id` is the bank account id (the
 read-only `dolibarr-payments-state` skill lists them; `ai_agent_sandbox` does not
 yet have `banque lire`, so pass the id). Emits the new payment id.
 
+### 4 · Credit note (avoir) — `scripts/creditnote-create.sh`
+
+```sh
+echo '{"socid":42,"source_invoice":19,"validate":true,
+       "lines":[{"desc":"Avoir partiel conseil","qty":1,"price_ht":100,"tva":20,"type":"service"}]}' \
+  | scripts/creditnote-create.sh
+```
+A customer invoice of `type=2` referencing `source_invoice` (`fk_facture_source`);
+amounts come out negative (a credit). `validate:true` turns the draft into a
+numbered `AVC…` avoir. Emits `{id, ref, total_ht, total_ttc, fk_facture_source, statut}`.
+
 ## Gotchas
 
 - **Validate before paying.** A draft (`statut=0`, ref `PROV…`) cannot be paid.
@@ -113,5 +124,8 @@ yet have `banque lire`, so pass the id). Emits the new payment id.
 - **Dates** are sent as Unix epochs; pass `date:"YYYY-MM-DD"` or omit for today.
 - **`banque lire`** isn't granted yet → `GET /bankaccounts` returns empty. Add it
   to the provisioner's rights set if account discovery from this skill is needed.
-- **Avoirs (credit notes)** are a planned follow-up (a customer invoice with
-  `type=2` referencing the original).
+- **Avoirs (credit notes)** → `creditnote-create.sh` (customer invoice `type=2`
+  referencing `source_invoice`; amounts negative, ref `AVC…`). Supplier avoirs
+  are a follow-up.
+- **CLI:** all of these are also `arcodange sandbox {thirdparty|invoice|payment|creditnote|write}`
+  (JSON on stdin) — `arcodange sandbox help` for the list.