feat: Git-backed Skill Collections for v0.9.0

[santosli]

Target

Git-backed Skill Collections Phase C targets v0.9.0. Phase A+B shipped in v0.8.0. Phase C is implemented on main and remains unreleased pending v0.9.0 release qualification. Phase D remains planned for a later v0.9.x release. The repository does not currently have a GitHub milestone for this target, so this issue records the target without creating new milestone administration.

Product model

• A collection is a Git repository/source entity; child SKILL.md directories remain independent deployable skills.
• Collection identity is the canonical Git worktree/repository identity plus ref/HEAD. A GitHub remote is optional.
• A collection follows one reviewed commit SHA. Children must not silently drift across unrelated SHAs.

Delivery status

• A. Repository detection and local Import Review grouping, shipped in v0.8.0.
• B. Collection/source persistence and child relationship, shipped in v0.8.0 with the schema-v8 collection/member model.
• C. GitHub multi-skill install preview/apply with one fetch, shipped in v0.9.0.
• D. Collection-level update/rollback and UI detail, planned after Phase C for a later v0.9.x release.

Local import (Phase A+B shipped)

• During the read-only Import Review scan, resolve each candidate's real path and nearest safe Git root.
• Group candidates from the same canonical Git repository into one collection card.
• Support normal repositories and Git worktrees; nested repositories are separate collections.
• Runtime symlinks resolving to a child in the same worktree map to the same collection and child.
• Copies outside Git metadata are standalone/unlinked candidates even when content looks similar.
• Show repository path, optional remote, branch/HEAD, skill count, and an expandable/searchable child list.
• Allow individual child selection or select all. Never deploy automatically.

GitHub and remote collections (Phase C shipped in v0.9.0)

• Preview a repository /tree/<ref> URL once and scan it for multiple valid SKILL.md children.
• Use one bounded fetch/check per repository rather than one fetch per skill.
• Preview valid, invalid, duplicate, and managed-conflict children with bounded diagnostics.
• Apply selected child snapshots while retaining collection provenance and one reviewed resolved SHA.
• Root-only URLs continue through the existing single-skill flow; bare repository URLs require an explicit ref so the reviewed commit is unambiguous.
• A root collection URL cannot safely infer a slash-containing ref from /tree/<...>; use an unambiguous commit SHA or a ref without slash. A slash-containing ref is parsed only when a known child skill-root segment disambiguates ref from path.
• Collection update/rollback remains outside Phase C and is planned for Phase D.

Safety requirements

• Scan is read-only.
• Apply rechecks canonical source, explicit ref, resolved SHA, tree snapshot, selected children, and managed state before any write.
• Nested or overlapping skill roots, traversal, unsafe paths, symlinks, gitlinks/submodules, oversized trees, and duplicate/conflicting names fail closed.
• Never execute hooks, submodules, filters, repository scripts, custom helpers, or arbitrary shell strings.
• Preserve traversal, symlink escape, size/count, non-symlink overwrite, backup/revert, and duplicate-name protections.
• Invalid children are blocked and never silently imported.

Acceptance gates

• A local repository with dozens of skills appears as one collection with N children.
• Symlinked runtime copies do not duplicate children.
• Standalone copies remain standalone.
• Remote collection preview performs one repository fetch/check with production fetch-count coverage.
• Collection state is consistent with one reviewed SHA.
• Child selection is explicit.
• Per-skill deploy and Calls remain independent.
• Phase C recovery and untrusted-tree regressions pass.
• CLI and Tauri expose parity for the Phase C collection operations.

Out of scope for this tracking issue

• Automatic deployment.
• Content-similarity membership without Git provenance.
• Silent conflict resolution or cross-SHA child drift.
• GitHub collection-level update/rollback until Phase D.