fix(skillpack): address review — symlink read, git arg-injection, dup-subscribe, nil panics

Real issues from the PR review:
- security: readTree now skips symlinks (a pack with SKILL.md -> /etc/passwd
  or scripts/x -> ../../.ssh/id_rsa could read host files); covers file and
  dir symlinks, incl. within a git subpath
- security: GitSource rejects url/ref beginning with '-' (git arg injection)
  and clones with '--' separator; --filter=blob:none (blobless partial clone)
  instead of full-history clone
- correctness: Subscribe no longer swallows a non-ErrNotFound store error from
  GetByName (would create a duplicate subscription); handles *GitSource as well
  as GitSource in the URL/subpath extraction
- correctness: pinTo no longer renames a subscription, so Apply can't silently
  collide two subscriptions when an upstream pack changes its name
- validation: isKebab rejects leading/trailing/consecutive hyphens; BOM-
  prefixed SKILL.md now parses (matches the doc comment)
- robustness: Catalog/Activate/renderPackBody/Stage guard nil/malformed packs
- test cleanup: Syncer.Store field renamed Cache (collided with the Store
  interface); test NewID returns distinct ids
- tests: symlink-skip, BOM, strict-kebab, nil-pack-safety

Deferred (advisory perf, documented): PackCache stores raw trees so activation
re-parses; CheckAll is serial. Both fine at expected scale.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

skillpack/pack.go

@@ -107,6 +107,14 @@ func readTree(fsys fs.FS) (Tree, error) {
 		if d.IsDir() {
 			return nil
 		}
+		// Skip symlinks. A pack must be self-contained; os.DirFS + ReadFile
+		// follows symlinks, so a malicious pack with `SKILL.md -> /etc/passwd`
+		// or `scripts/x -> ../../.ssh/id_rsa` would otherwise read host files
+		// into the tree. WalkDir yields a symlink-to-dir as a non-dir entry
+		// carrying ModeSymlink, so this one check covers file and dir symlinks.
+		if d.Type()&fs.ModeSymlink != 0 {
+			return nil
+		}
 		b, err := fs.ReadFile(fsys, p)
 		if err != nil {
 			return err