Acquire Codex skill packages from GitHub

[Aaronontheweb]

Netclaw needs a safe package boundary before the runtime can publish public Git skills.

This change resolves public GitHub branches and acquires exact commit archives. It imports only selected skill folders and their bundled files.

The importer rejects unsafe paths, selected links, special files, duplicate paths, invalid manifests, invalid skills, and exceeded resource limits. It ignores unselected repository links and archive-level PAX metadata.

The immutable path includes the source fingerprint and commit. A source change cannot reuse stale content from the same commit.

The importer sends the required GitHub user agent. It accepts only the controlled HTTPS redirect to codeload.github.com.

Validation:

• All 37 focused acquisition tests passed.
• The pinned public dotnet-skills commit loaded 36 skills and bundled resources.
• Two independent reviews found no unresolved defects.
• Format verification passed.
• Slopwatch passed.
• The copyright header check passed.
• The diff check passed.

Depends on #2153.
Part of #2134.

Pull request stack

Review and merge these pull requests in this order:

1. #2153: Add managed Git skill plugin state
2. #2154: Acquire Codex skill packages from GitHub (this pull request)
3. #2156: Publish managed Git skill plugins during external sync
4. #2157: Add daemon API for managed Git skill plugins
5. #2158: Add CLI management for Git skill plugins

This pull request is step 2 in the stack.

[Aaronontheweb]

This pull request used a fork branch as its head. GitHub could not include it in the same-repository stack. #2161 replaces it with the identical upstream commit.