feat(import): group review candidates by skill

[santosli]

Summary

• add a Rust-owned import candidate group/variant/location contract with stable IDs, strict full-snapshot equivalence, deterministic primary selection, and deduplicated Calls totals
• render one Import Review card per normalized skill name with accessible location disclosure and explicit variant radios when same-name sources differ
• submit exactly one selected primary source per group and reject duplicate same-name batch requests before managed-store writes
• update public and architecture/workflow documentation for grouped review behavior

Safety contract

• React consumes Rust grouping and does not infer filesystem equivalence
• equivalent locations remain provenance-only through additional_source_paths
• multiple materially different importable variants require explicit selection
• imported, system, and conflicting variants remain visible but cannot be submitted
• User/Remote changes apply only to the selected variant
• the legacy flat candidates response remains available for compatibility

Verification

• cargo fmt --check
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo test --offline: CLI 29, core 323, desktop Rust 10, git 41, github 8; all passed
• npm test: 257/257 passed
• npm --workspace apps/desktop run build
• npm audit --audit-level=high: 0 vulnerabilities
• cargo audit: no vulnerability failure; 18 existing allowed warnings
• git diff --check

Visual QA

• collapsed desktop: /tmp/skillbox-import-groups-collapsed.png
• expanded desktop: /tmp/skillbox-import-groups-expanded.png
• selected variant: /tmp/skillbox-import-groups-expanded-selected.png
• narrow 1000x760: /tmp/skillbox-import-groups-narrow.png
• desktop and narrow checks both reported zero horizontal overflow

Draft for PM review. Do not merge or release.