Publish managed Git skill plugins during external sync

[Aaronontheweb]

Netclaw can acquire Git plugin archives, but the external sync pass cannot publish their skills.

This change adds Git plugins to the existing actor-owned sync pass. It publishes one complete inventory snapshot after all sources finish.

The runtime keeps each published commit immutable until the next daemon restart. Active resource calls can finish from their selected revision.

A failed candidate or receipt write keeps the prior receipt and registry active. Disabled sources leave the registry without deleting their durable receipt.

The runtime skips known rejected commits. It emits one durable security alert claim for each confirmed scanner rejection.

Managed plugin files deny agent writes. Native skills, server feeds, managed Git plugins, and local sources keep their defined precedence.

Validation:

• All 75 focused daemon tests passed.
• All 4 inventory tests passed.
• Deterministic tests cover watcher refreshes, receipt failures, restart cleanup, and prior revision access.
• Format verification passed.
• Slopwatch passed.
• The copyright header check passed.
• The diff check passed.
• An independent review found no material runtime defects.

Depends on #2154.
Part of #2134.

Pull request stack

Review and merge these pull requests in this order:

1. #2153: Add managed Git skill plugin state
2. #2154: Acquire Codex skill packages from GitHub
3. #2156: Publish managed Git skill plugins during external sync (this pull request)
4. #2157: Add daemon API for managed Git skill plugins
5. #2158: Add CLI management for Git skill plugins

This pull request is step 3 in the stack.

[Aaronontheweb]

This pull request used a fork branch as its head. GitHub could not include it in the same-repository stack. #2162 replaces it with the identical upstream commit.