Support pinned GitHub Skill metadata

[sheepxux]

Fix

Allow the optional metadata.github-pinned string that GitHub CLI adds when a Skill is installed with gh skill install --pin.

The validator still requires the four standard GitHub source-tracking fields and rejects unknown metadata keys. The regression test now models an actual pinned installation, and the real pinned v1.0.0 installation validates successfully.

Validation

• targeted validation suite passes
• loopctl skill validate passes against a real gh skill install --pin v1.0.0 copy
• loopctl doctor passes

---

Summary by cubic

Allow Skills installed with gh skill install --pin to validate by accepting the optional metadata.github-pinned string. Validation still requires github-path, github-ref, github-repo, and github-tree-sha, rejects unknown keys, and tests now include a pinned install case.

^{Written for commit a596e55. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}