fix: prefer install_meta.url over enclosing-repo source.url for grouping

[SherlockSalvatore]

Summary

Fixes #75. A skill installed to multiple agents could split into two group rows in the Extensions list when one agent's home directory is kept under the user's own dotfiles git repo.

Root cause

deriveExtensionUrl (the grouping key's developer resolver) used the order source.url → install_meta.url → pack. source.url comes from the scanner walking up to the nearest .git remote. When an agent home such as ~/.claude sits inside a personal backup repo, the scanner stamps the skill with that enclosing remote (the user's own dotfiles repo), which masked the authoritative install_meta.url and forked that copy into its own group — even though all copies were installed from the same source.

Fix

Flip the resolution order to install_meta.url → source.url → pack. install_meta.url is written by HK at install time and is not user-editable, so it is the authoritative origin and should win first. source.url stays the fallback for git-cloned skills that carry no install_meta. No DB migration needed — grouping is recomputed on every list.

This also makes deriveExtensionUrl consistent with isItemInstalled (marketplace.tsx), which already prefers install_meta over source.url.

Test plan

• npm test — 224 passing (incl. 1 new regression test for the polluted source.url case; verified it fails on the old order and passes on the new)
• npx tsc --noEmit clean
• npx biome check src/ clean
• Manual (cargo tauri dev): a skill deployed across agents collapses from two rows into one, with all agents listed

Before / After

Before (two rows):

After (one row):

[RealZST]

Thanks for the PR! Merged.