feat(extensions): manual source binding for locally-installed skills

[RealZST]

Summary

• Let users bind a GitHub repo to a locally-scanned skill that has no source detected, opting it into Check Updates / Update.
• Replace the "No source" input with a three-state pill (CTA → editing → linked) that normalizes URL paste forms and rejects non-github / malformed input before write.
• Wire the new install_type = "manual" through check_updates (bucket + skill-name verification) and update_extension (whitelist) so manually-bound rows are first-class in the update pipeline.

How it works

• service::bind_pack is the single write path for the detail panel's source field. It synthesizes install_meta { install_type: "manual", url, revision: None } for sourceless rows and refreshes/clears it when the user edits/unbinds. Real git / marketplace install_meta is never touched — a user-typed pack is just a grouping hint when a real install exists.
• normalize_pack accepts: bare owner/repo, https://github.com/owner/repo[.git][/tree/main], schemeless github.com/..., and git@github.com:owner/repo.git. Non-github paste forms (e.g. gitlab.com/foo) are rejected by the validator so we never synthesize a wrong https://github.com/... URL.
• migrate_pack_to_manual_meta is invoked at the top of every check_updates; idempotent, opts in pre-feature rows that had pack typed before this flow existed.
• check_updates clones the bound repo and verifies the skill name actually lives in it. If not (typo / wrong repo), surfaces RemovedFromRepo immediately rather than waiting for the user to click Update and hit the same check.
• Frontend pill is a three-state machine: empty → + Bind source CTA → click → input (autofocus, Enter commits with toast on invalid, Esc cancels, blur silently dismisses) → success → link chip + pencil to re-edit.
• New INFO-section row surfaces UpdateStatus::Error (network errors, missing repos, etc.) — previously dropped silently in the UI.

Test plan

• cargo test -p hk-core — 432 / 432 pass (+18 new tests covering normalize, validate, bind_pack matrix, migrate)
• npm run test — 164 / 164 vitest (+15 helper tests for normalizePack / isValidPackFormat / groupOwnerRepo incl. CLI fallback)
• npm run lint — clean
• cargo check --workspace — all 4 crates compile
• E2E manual: created a local stub webapp-testing/SKILL.md with placeholder content → bound to anthropics/skills → Check Updates correctly flagged update_available (not removed_from_repo, since the skill exists in that repo) → Update succeeded; version chip appeared; local SKILL.md was replaced with the real webapp-testing content from the repo.
• Edge cases manually verified:
  • 5 URL paste forms all normalize to owner/repo
  • 6 invalid inputs (no slash / multi-slash / spaces / non-github URL / gitlab.com/foo / google.com/foo) all show toast.warning and stay in edit
  • Unbind via empty input clears install_meta + drops stale removed_from_repo warning
  • Cmd+A inside input doesn't bubble to document
  • Detail panel survives binding (selectedId re-resolved after groupKey change)
  • Pencil click reliably enters edit mode (fixed a useEffect dep bug that was racing the edit toggle)

Refs #39 (A3).

🤖 Generated with Claude Code