feat(sdk): support public GitHub skill bundles

[samzong]

Summary

• Add public GitHub skill bundle constructors and resolution across TypeScript, Go, and Rust.
• Preserve the existing user-facing install workflow while recording GitHub provenance in .kitup.json.
• Update docs, boundaries, and shared golden cases for install, dry-run, resolve failure, and unchanged behavior.

Scope Check

• Stays within the v0.1 bundled-skill installer boundary as updated for public GitHub bundle directory resolution.
• Does not add marketplace, registry, private remote install, script execution, GUI, MCP server, or agent runtime behavior.
• Updates golden cases for observable installer behavior changes.
• Regenerates host constants after spec/hosts.json changes. Not applicable; host spec was not changed.

Verification

• make check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: caa4a52658

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".