fix(skills): match marketplace installs by repository and skill name

[kev1n77]

Summary

Fix incorrect installed indicators for marketplace skills that share a name across different repositories.

Read repository provenance from existing installer lock files and use repository plus skill name consistently for cards, details, install buttons, and sorting.

Type and Areas

Type: Bug fix

Areas: Rust core, Agent Runtime contracts, Web UI, tests

Motivation / Impact

Installing one eli5 skill previously marked unrelated eli5 listings as installed and disabled their install buttons.

Only the matching repository and skill now receive installed status. Existing skills without provenance remain available without being matched by name alone.

Verification

All checks passed:

• pnpm run fmt:rs
• git diff --check
• pnpm run check:web
• Frontend: 14 tests

  pnpm --dir src/web-ui exec vitest run src/infrastructure/config/skillMarketInstallation.test.ts src/app/scenes/skills/hooks/useSkillMarket.test.tsx src/app/scenes/skills/SkillsScene.presentation.test.ts

• Runtime contracts: 31 tests

  cargo test --locked -p openbitfun-agent-runtime --no-default-features --features agent-runtime --test agent_definition_contracts skill_contracts::

• Core skills: 29 tests

  cargo test --locked -p openbitfun-core --no-default-features --features agent-runtime,git --lib agentic::tools::implementations::skills::

Reviewer Notes

• installationSource is optional and supports legacy payloads.
• Existing lock files are read without rewriting or deleting user data.
• Tests cover duplicate names, refreshed installation state, legacy lock versions, and malformed provenance.
• Remote workspace reads are covered with a simulated filesystem. Live SSH, remote control, Peer Device Mode, and Detached Dispatch were not exercised.
• No user-facing strings changed.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.