Add skill version pinning via git tags and commit SHAs

[albertodebortoli]

Description

• Adds an optional ref: field to skill definitions in Lucafile, allowing skills to be pinned to a specific git tag (e.g. v1.2.0) or commit SHA1 (e.g. abc1234)
• Adds --ref flag to luca install for individual skill installs
• When no ref is specified, existing HEAD behaviour is preserved
• Tags and branches use shallow clone (--depth 1 --branch <ref>); commit SHAs use a full clone followed by git checkout <sha>
• Closes no open issue (new feature)

skills:
  - name: frontend-design
    repository: vercel-labs/agent-skills
    ref: v1.2.0         # git tag
  - name: my-skill
    repository: owner/repo
    ref: abc1234        # commit SHA

Type of Change

• Feature

How Has This Been Tested?

• Added / updated unit tests
• Swift code builds locally (swift build)
• Tests pass locally (swift test) — 371 tests, all passing

New tests added:

• GitRepositorySkillFetcherTests: 5 new cases covering tag cloning, SHA checkout, checkout failure, cache key isolation per ref
• SkillsInfoFactoryTests: 4 new cases covering ref propagation to SkillSet, first-ref-wins for same-repo skills, and --ref on individual installs
• ErrorDescriptionTests: coverage for new checkoutFailed error case
• New fixture: Lucafile_mock_with_versioned_skills.yml

Checklist

• Swift code builds locally (swift build)
• Tests pass locally (swift test)
• Code style / formatting respected
• Documentation updated (DocC comments on new fields, Lucafile example updated)

Breaking Changes?

• No — ref defaults to nil on all models; all existing Lucafiles and call sites are unaffected

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!