feat: add safe local skill installation

[eric7h]

Summary

• load bundled and user-installed skills from ordered roots
• add safe local folder installation with metadata, collision, symlink, file-count, and package-size validation
• install atomically under ~/.finagent/skills and move removals to Trash
• expose install/remove through Electron IPC and the Settings → Skills UI
• let the Pi runtime resolve resources from bundled and user skill roots
• document the workflow and extend Skills interaction coverage

Validation

• focused tests: 63 passed, 0 failed
• Skills Electron E2E: 9/9 passed
• bun run typecheck
• bun run i18n:check
• bun run build
• git diff --check

Full-suite baseline note:

• origin/main: 811 passed, 337 failed
• this branch: 824 passed, 337 failed

The existing failures reproduce on origin/main and begin with missing Longbridge fixture files; this change adds no new failures.

[helsome]

Review 结论：Request changes。\n\n[P1] 标准 YAML 多行 description 解析错误。项目中的 description: | 和 description: > 会被解析成字面量 | / >，因为当前 frontmatter parser 只解析单行标量。仓库自身的技能包（例如 skills/longbridge-content/SKILL.md）就使用了这种格式。\n\n我实际验证到：技能 description 变成 |，触发关键词数量变为 0。这样本地安装虽然能成功，但设置页和技能路由会丢失真实描述与触发词。\n\n请修复块字符串解析，或改用 YAML parser，并增加 | / > 格式的回归测试。相关代码：packages/skill-hub/src/index.ts:491-545。