AD: lead with one-call charm_knn_scores / charm_zero_shot_scores

Sync the CHARM skill + AD demo with the one-call best recipe (PR #1590 in the source repo).

- SKILL.md 'Detect without labels' bullet now starts users on charm_knn_scores (clean reference) / charm_zero_shot_scores (none) instead of the single-scale building blocks.
- demo_retrieval_anomaly_detection.ipynb imports the two one-call functions at the top and adds a 'Start here - one call' section before Approaches A-D, so the first runnable AD path is the VUS-PR 0.631 recipe rather than the weaker single-window min-max pipeline.

skills/charm/SKILL.md

@@ -71,8 +71,9 @@ These patterns are starting points; combine them:
 - **Detect without labels.** Score windows by distance to normal behavior. Add cheap window
   statistics, because normalized embeddings miss level shifts and spikes. With no clean
   reference, bootstrap one — and show the user *which* periods were selected as normal before
-  trusting the scores. The recipes are ranked in `anomaly-detection.md`, which also has a
-  symptom→knob tuning guide (window, stride, k, distance, pooling) and an evaluation snippet.
+  trusting the scores. Start with `charm_knn_scores` (clean reference) or
+  `charm_zero_shot_scores` (none): each runs the best recipe in one call. `anomaly-detection.md` explains
+  them and the lower-level building blocks, with a symptom→knob tuning guide and an evaluation snippet.
 - **Embeddings as features.** Feed vectors, plus window statistics and metadata you already have,
   into sklearn models. This is the fastest supervised baseline.
 - **Escalate to a trained head only when needed.** If a zero-shot or sklearn baseline falls short