refactor(skills): support multi-file skills and fail-fast on bad bundles

Description

Follow-up to !3235 (merged). Two operational improvements after reviewing the Agent Skills specification:

Multi-file skills. bundled.Skill now carries Files map[string][]byte rather than a single Content []byte. bundled.load() walks each skill directory in the embedded FS, and install.installOne writes every entry preserving relative paths. The two bundled skills today are still single-file, so behavior is unchanged — but the model now round-trips the optional scripts/, references/, and assets/ directories the spec calls out, which we'll need for richer bundled skills and any future remote-skill support.

Lefthook fail-fast. A new validate-skills pre-commit hook runs the bundled package tests when anything under internal/commands/skills/bundled/ is staged. The tests exercise bundled.All(), so a missing SKILL.md, unparseable frontmatter, or empty name/description fails at commit time instead of in CI or in front of a user.

Why not port the agentskills.io validator into Go?

The spec recommends skills-ref validate, but its README states "This library is intended for demonstration purposes only. It is not meant to be used in production." Porting the spec rules (name regex, length caps, etc.) into Go would create a parallel implementation that silently drifts as upstream evolves. We deliberately stop at the minimum frontmatter checks needed for the registry to function and leave full spec compliance to MR review.

Related

Depends on !3235 (merged). Retarget to main once that merges.

How has this been tested?

• Updated bundled and install tests cover the new multi-file shape, including a direct TestInstallOne_WritesAllFiles exercising scripts/, references/, and assets/ paths.
• Verified the validate-skills hook fires by staging a bundled change and running lefthook run pre-commit locally.
• glab skills install glab-stack --path /tmp/x continues to install a complete skill.

Screenshots (if appropriate):

N/A