fix(validation): accept any-case SKILL.md filename on upload

[XiaoSeS]

Closes #458.

Summary

• Upload of a skill package with skill.md (lowercase, or any other case variant) previously failed with Missing required file: SKILL.md at root. This was a frequent papercut on macOS / Windows because their case-insensitive filesystems happily let authors save the file with non-canonical casing.
• Root cause: five call sites compare entry paths against the constant SKILL_MD_PATH = "SKILL.md" using case-sensitive .equals(...).
• Fix: fold the basename to the canonical SKILL.md inside SkillPackagePolicy.normalizeEntryPath(...) — the single normalization point both SkillPackageValidator and SkillPackageArchiveExtractor already route every path through. Every downstream comparison then succeeds without further changes.

The OpenSkills protocol declares uppercase SKILL.md as the canonical filename, so accepting any case but storing the canonical form is the right semantic — not a workaround.

Test plan

• SkillPackageArchiveExtractorTest — 3 new regression tests: lowercase skill.md at root, mixed-case Skill.MD inside a single root directory, lowercase skill.md requiring directory promotion. 18/18 pass.
• SkillPackageValidatorTest — 1 new test covering the validator-only path (e.g., CLI dry-run that doesn't go through the extractor). 17/17 pass.
• Full sweep on SkillPublishControllerTest, CliDryRunValidateTest, BasicPrePublishValidatorTest, SkillPublishServiceTest — no regressions. 27 tests, 0 failures.

[gemini-code-assist]

Code Review

This pull request introduces automatic canonicalization of the SKILL.md filename to ensure case-insensitive matching. It includes logic in SkillPackagePolicy to fold case variants (like skill.md or Skill.MD) to the uppercase SKILL.md and adds comprehensive unit tests in SkillPackageArchiveExtractorTest and SkillPackageValidatorTest to verify this behavior across different directory structures and validation scenarios. I have no feedback to provide.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

PR Review Helper seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[FenjuFu]

这个方案我们采用了（extractor 层 canonicalize + 回归测试比只改 normalizeEntryPath 更完整），同题的 #459 已关闭。分支目前和 main 有冲突，请 rebase 一下，解决后优先合。

[XiaoSeS]

This was generated by AI during triage.

已确认该 PR 解决的问题已由 #507 完整实现并合入 main。#507 除共享校验逻辑外，还覆盖了 portal/CLI/兼容上传入口及相关文档；本地针对性回归测试共 37 项通过。因此关闭此冲突分支，保留 #507 作为最终实现。