fix(core): group verified well-known skill sources

[santosli]

Summary

• accept strictly validated v3 sourceType=well-known installer provenance as a display-only Installed Source Collection
• group only candidates with the same verified source kind and normalized HTTPS sourceBaseUrl; keep live Git precedence, singleton behavior, snapshots, type/status/conflict handling, and per-skill apply unchanged
• document the GitHub and well-known provenance boundaries and preserve existing GitHub installed-source IDs

Root cause and local reconciliation

The parser accepted only sourceType=github, so valid well-known entries were rejected before candidate matching. Aggregate-only local verification after the fix reports 70 candidates, one lockfile scanned, 65 validated/matched entries, six invalid entries, three installed-source collections, and exactly one open.feishu.cn collection with 28 children and zero lark-* standalone groups. No local paths or skill contents were logged.

Trust boundary

• sourceType must be exactly well-known
• base and child URLs must be HTTPS with no userinfo, query, fragment, control characters, or unsafe path components
• child URL must equal <normalized-base>/.well-known/skills/<validated-name>/SKILL.md
• the lock entry key, scanned candidate name/root/path, and a well-formed SHA-256 digest must all validate
• source kind participates in grouping identity, so GitHub and well-known entries never coalesce merely because a URL or name prefix matches
• lockfile provenance grants no network, branch, HEAD, update, deploy, or filesystem authority

Verification

• focused well-known regressions: 4 passed
• focused existing installed-source regressions: 3 passed
• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo test --offline: 458 passed
• npm test: 280 passed
• npm --workspace apps/desktop run build
• npm audit --audit-level=high: 0 vulnerabilities
• cargo audit: no vulnerabilities; 18 repository-policy warnings
• git diff --check

Visual QA

• /tmp/skillbox-lark-installed-source-collapsed-1600.png (1600x900)
• /tmp/skillbox-lark-installed-source-expanded-1600.png (1600x900)
• /tmp/skillbox-lark-installed-source-expanded-1000.png (1000x760)

The privacy-safe deterministic QA fixture used the production Installed Source Collection component with Lark-shaped names and was restored before commit. At 1000px the dialog is 936px wide, the collection is 898px wide, and page scrollWidth equals 1000px with no horizontal overflow. The real child count/grouping evidence comes from the aggregate Rust scan above.

This PR is independent of Draft PR #66 and contains none of its collection-header layout changes.