Implement safe plugin materialization for skills

[yacosta738]

Goal

Materialize the skill portion of a pinned plugin into AgentSync's canonical source so the existing fan-out makes it available to Claude, Codex, Gemini, and OpenCode.

Scope

• Fetch/extract a plugin from the resolved source into a staging directory.
• Validate the plugin manifest and each skill manifest.
• Preserve skill-local references/assets required by SKILL.md.
• Define namespacing and collision behavior for skills from multiple plugins.
• Install/update/remove atomically with rollback.
• Record plugin-to-skill provenance and content hashes.
• Support dry-run and offline apply from the lockfile/cache.
• Fail clearly for unsupported plugin components rather than silently dropping them.

MVP boundary

Only skills are materialized here. Hooks, scripts, binaries, plugin agents, apps, LSP configuration, and vendor-specific lifecycle behavior remain unsupported and must be reported.

Security requirements

• Reject archive path traversal and unsafe symlinks.
• Enforce download/extraction limits.
• Never execute plugin code.
• Do not allow materialized content to escape the project root or managed cache.

Acceptance criteria

• A fixture plugin with multiple skills installs into the canonical layout and fans out through existing configured agents.
• Reinstalling the same lock entry is idempotent.
• A changed hash or invalid manifest fails without corrupting the previous installation.
• Skill name collisions have deterministic, tested behavior.
• Update and remove clean up only AgentSync-owned materialized paths.
• Unit and integration tests cover local fixture, archive, pinned remote metadata, rollback, and drift.

[linear-code]

DALLAY-587