feat(skills): load skills from public GitHub repositories

[dgageot]

Agents that want ready-made skills today either embed them inline or point at a URL that implements the well-known skills discovery spec. Neither option covers the common case of "there's a public GitHub repo full of skills I want," which today means cloning it by hand and pointing a local source at the checkout.

This adds a GitHub-aware branch to the skills loader. A skills: entry that is a https://github.com/owner/repo URL (optionally a /tree/<ref>/<dir> form, or ?ref=/&path= query parameters) resolves against the GitHub API to a commit SHA, downloads a tar.gz snapshot from codeload.github.com with bounded, path-safe extraction, and caches the result immutably by repository, commit, and directory. Mutable refs (branches, tags, or no ref) are re-resolved every five minutes; a pinned 40-character SHA never re-resolves and a warm cache makes no network calls. An optional GITHUB_TOKEN, read through the agent's configured environment provider, is sent only to api.github.com to raise rate limits, never to the archive host, and never enables private repositories. pkg/teamloader now routes skill-loading failures into load-time warnings instead of a hard failure, so one broken source doesn't take down the others.

A full review was done on this branch and requested changes before merge. Per the current request, this PR is opened as a draft to get the diff in front of reviewers rather than patched blind; none of the findings below have been fixed yet.

Known issues from review

• A rejected source URL, including any credentials embedded in it, is echoed verbatim into the load-time warning message.
• Canceling one caller's context aborts the singleflight-shared load for every other caller waiting on the same GitHub source.
• The frontmatter closing-fence rewrite in pkg/skills/frontmatter.go regresses parsing of existing local skills whose frontmatter has trailing whitespace before the closing ---.
• Extracted archive entries are always written with mode 0600, so executable scripts under a skill's directory lose their executable bit.
• The frontmatter parser still doesn't support YAML block scalars (|, >) for description, a gap now more likely to be hit as remote skills become easier to add.
• The host's GITHUB_TOKEN is not forwarded into the sandbox environment provider, so sandboxed sessions silently lose the GitHub authentication the docs describe.
• Valid dot-prefixed repository or owner names are rejected by the name validation reused from local skills.
• An empty ref segment in a /tree//skills URL silently resolves to the default branch instead of being rejected as malformed.

There are also open questions flagged but not yet root-caused around cache corruption recovery, whether credentials could leak across concurrent loads sharing a singleflight key, and the exact visibility semantics when a repository's public/private state changes between resolution and reuse. These need follow-up before this is safe to merge.