Add managed Git skill plugin state

[Aaronontheweb]

Netclaw needs durable source state before it can install public Git skill packages.

This change adds validated Codex plugin source configuration, immutable managed paths, and SQLite receipt and rejection records. It also adds explicit scanner failure results and a security alert category.

The state tracks the installed commit and the last observed commit. Branch sources can suppress repeat downloads after a same-version result.

Durable references use two forms:

• Branch follows a named branch.
• Commit stays on an exact commit.

A future CLI tag option will resolve the tag once and store its exact commit.

The skill sources editor preserves plugin entries when an operator changes or removes a server feed.

Validation:

• 21 source validation tests passed.
• 6 SQLite state tests passed.
• 1 doctor schema test passed.
• 41 skill sources editor tests passed.
• Slopwatch passed with no findings.
• The copyright header check passed.
• The diff check passed.

Part of #2134.

Pull request stack

Review and merge these pull requests in this order:

1. #2153: Add managed Git skill plugin state (this pull request)
2. #2154: Acquire Codex skill packages from GitHub
3. #2156: Publish managed Git skill plugins during external sync
4. #2157: Add daemon API for managed Git skill plugins
5. #2158: Add CLI management for Git skill plugins

This pull request is step 1 in the stack.

[Aaronontheweb]

This pull request used a fork branch as its head. GitHub could not include it in the same-repository stack. #2160 replaces it with the identical upstream commit.