Forgiving imports and skill metadata

Importing real-world skill collections became far more forgiving:

• Benign content-length checks are now override-able warnings instead of hard failures — you can publish or import through them knowingly.
• Imports are per-skill: a single spec-violating skill is skipped and reported, not fatal to the others in a repo.
• A generic skill-metadata store now records GitHub import provenance — a source badge, a link back to the repo, and re-sync.