feat: integrate skills.sh registry with chain-loading detection

[homanp]

What

• Add SkillsAdapter for fetching Agent Skills from GitHub repos
• Add skill-specific scan prompt targeting chain-loading, prompt injection, and social engineering patterns in SKILL.md files
• Add SkillChainLoading threat type with dedicated detection
• Add skill_chain_loading to verification prompt so Opus preserves the type
• Mark Opus-verified threats as Verified so they affect risk level
• Store verification_status in DB on threat insert
• Add skills-specific CLI output (repo, trust, threats) — skip CVEs, install scripts, downloads not applicable to skills
• Extract referenced skill identifiers and queue nested dependency scans with depth-1 recursion cap via DB existence check
• Add JSON salvage fallback for malformed LLM output
• Wire up Fireworks minimax-m2p5 for initial scans, Bedrock Opus for verification across all registries
• Add ripgrep to worker Dockerfile, clean stale opencode package.json
• Run OpenCode scans sequentially to avoid SQLite lock contention
• Skip usage docs generation for skills (SKILL.md is the doc)

Why

We want to scan skills.sh

Test plan

• Tests pass locally
• Tested manually