feat: add Codex-native Skill convergence and public marketplace - #4

What

• adds safe Skill convergence with canonical-version selection, projection records, stale-state checks, rollback, and beginner/advanced organizer views
• separates detected Agent installations from compatible/shared Skill exposure
• packages SkillManager as a strict-semver Codex Plugin with a local-only MCP and session-protected Dashboard
• builds one universal Node.js 20+ release with all 12 lockfile-verified @napi-rs/keyring native targets
• adds the selected Convergence Rails identity, real product screenshot, public install page, privacy policy, terms, support, and security guidance

Why

Users often have independent copies of the same Skill under Codex, Claude Code, Cursor, and shared .agents paths. The current UI can list them but cannot safely explain or consolidate them. This change creates a recoverable path from scattered copies to one canonical Skill without treating every compatible Agent as installed.

Impact

• filesystem writes remain plan-bound, explicitly confirmed, stale-checked, and recoverable
• MCP remains metadata-focused and does not return Skill bodies or local absolute paths by default
• Dashboard remains bound to 127.0.0.1 behind a 60-second, single-use launch link
• optional GitHub sync remains user-triggered; tokens stay in the OS credential store
• generated Marketplace artifacts remain ignored in the source repo and are published separately

Checks

• npm run lint
• npm run typecheck
• npm run test — 20 passed
• npm run test:integration — 22 passed
• npm run pack:verify
• npm run plugin:pack:verify — 12 native targets packaged; current macOS ARM binding loaded
• npm run audit:release — 0 vulnerabilities
• official Codex Plugin validator passed
• Skill validator passed
• in-app browser acceptance passed for desktop, narrow viewport, legal/support pages, copy interaction, and isolated Dashboard fixture
• local Marketplace installation from the generated clean artifact passed without removing skillmanager@personal

Publishing boundary

This is a draft PR. It does not merge the source branch or submit to an OpenAI-curated directory. The verified artifact will live in the independent public Backtthefuture/skillmanager-plugin Git Marketplace repository.