feat: support installing standalone skills from flat repos (npx skills ecosystem)

[christso]

Context

When implementing #228, we discovered a gap: allagents skills add <skill> --from <source> only works when the source repo uses the allagents plugin structure (skills/<skill-name>/ subdirectories). It silently fails on flat repos.

The Problem

npx skills installs skills from repos that contain SKILL.md files directly (flat structure):

vercel-labs/agent-skills/
├── vercel-react-best-practices/SKILL.md
├── vercel-nextjs-skills/SKILL.md
└── ...

allagents expects:

plugin-repo/
└── skills/
    ├── skill-name/   ← directory, not a flat file
    └── ...

So allagents skills add vercel-react-best-practices --from vercel-labs/agent-skills installs the plugin but finds no skills, because there is no skills/ subfolder.

Why the Current Schema Doesn't Cover This

enabledSkills/disabledSkills track skills as pluginName:skillName — they require a plugin entry in workspace.yaml. A standalone SKILL.md file has no plugin to anchor to.

Proposed Solution

Two options to evaluate:

Option A — Auto-wrap

When --from is used and the installed plugin has no skills/ directory, scan the repo root for SKILL.md files and auto-create synthetic skill entries. No schema change needed.

Option B — standaloneSkills schema addition

Add a new top-level array to workspace.yaml:

standaloneSkills:
  - source: "github:vercel-labs/agent-skills/vercel-react-best-practices"
    name: vercel-react-best-practices

This is more explicit and composable but requires a schema change and new sync logic.

Acceptance Criteria

• allagents skills add vercel-react-best-practices --from vercel-labs/agent-skills works
• Skills from flat repos are synced to configured agent directories
• allagents skills list shows them alongside plugin-based skills
• allagents skills remove can remove them
• Backwards compatible with existing disabledSkills/enabledSkills schema