Scanner incremental: read_single_skill + scan_one_skill com embedded fallback

[JonathLima]

What to build

Extract the single-skill parsing logic from scan_skill_dir into read_single_skill(), then add scan_one_skill(name) with embedded fallback.

Scope

• scanner.rs: extract read_single_skill(skill_dir, scope, trust, config, skip_pending) from scan_skill_dir inline logic, refactor scan_skill_dir to call it
• scan_one_skill(name, sources, config): iterate sources + fallback to embedded_skills::builtin_skills()
• lib.rs: export scan_one_skill
• Tests: filesystem scan, embedded fallback, skip pending, max_file_size, canonicalize

Acceptance criteria

• cargo test -p orquestra-skills passes
• read_single_skill returns Some for valid dirs, None for _pending when skip_pending:true
• scan_skill_dir behavior unchanged (delegates to read_single_skill)
• scan_one_skill(orquestra-grill) returns Some without filesystem (embedded fallback)
• scan_one_skill(nonexistent) returns None

Blocked by

None — can start immediately.