Fix Skipper #main isolation and source-grounded skill learning

[gitcommit90]

Summary

• make every personal #main a resident-free Skipper authority boundary in tool exposure, execution, runtime admission, migration cleanup, and database triggers
• expose Skipper’s authoritative assigned-computer inventory and default so absence of a resident VM is never mistaken for absence of Skipper computer access
• add an audited HTTPS-only source reader with DNS pinning, SSRF protections, redirect validation, response bounds, timeouts, digests, and evidence-gated skill creation
• reject unsupported source inspection, provisioning, skill creation, and missing-computer claims
• preserve purpose-relevant one-thread expert guests in ordinary channels while rejecting duplicate dispatch

Verification

• npm run typecheck
• npm run build
• npm test (114 native-world assertions; 48 Node tests)
• npm run test:onboarding-browser (20/20)
• git diff --check
• real production reader fetched https://openterminal.sh/ and the official Open Terminal README