Include skillsets in lock, sync, and verify

[jon-devlapaz]

Problem

Installed skillsets are receipt-backed project dependencies, but skill lock, sync, and verify operate only on standalone skills returned by check::load_project_skills.

A project containing only skillsets can therefore produce an effectively empty dependency lock, and later sync/verify without reproducing those skillsets.

Relevant code is in src/manifest.rs and src/check.rs.

Proposed change

Add first-class skillset entries to both the project manifest and lockfile. Each locked skillset should preserve:

• catalog name;
• immutable source URL and revision;
• sourceRoot;
• explicit member list;
• receipt/tree digest.

sync should restore through the normal atomic skillset installation path. verify should validate the installed receipt, declared members, and digest. The unified active-name collision policy should apply across locked standalone and grouped dependencies.

Acceptance

• Install a project containing only a skillset.
• lock records the full pinned skillset dependency.
• Delete the project skill tree and run sync; the exact skillset is restored.
• verify succeeds on the restored tree.
• Member or tree drift causes verify to fail clearly.
• Existing standalone-only lockfiles remain backward compatible.

Priority

P0 — reproducibility contract.