Install compatible RUDI stacks from public GitHub tree URLs

[rudijetson]

Summary

Allow rudi install to accept an exact public HTTPS GitHub tree URL for a
RUDI-compatible stack directory, pin the source to an immutable commit, and
install the stack together with its declared operator skill.

Evidence

• Implementation is complete in an isolated worktree based on current
  origin/main.
• Full CLI suite: 716/716 passed across 43 suites.
• Isolated stack-plus-operator integration: 1/1 passed.
• Build, package dry-run, changed-source debt scans, and git diff --check
  passed.
• Fresh-context independent review reported no blocking findings after
  remediation.
• A live public rejection smoke failed closed before mutation when the source
  lacked the required operator-skill path contract.

Affected Area

• Public GitHub tree parsing, ref resolution, and bounded subtree download
• Core resolver, installer transaction, and provenance lock
• rudi install and external-source update behavior
• Native operator-skill projection, MCP activation policy, help, tests, and
  generated CLI bundle

Invariants

• Accept exact public HTTPS github.com/<owner>/<repo>/tree/<ref>/<path> input
  only; reject credentials, foreign hosts, query/fragment data, traversal,
  symlinks, submodules, ambiguous refs, and incomplete downloads.
• Resolve mutable refs to one full commit SHA before installation.
• Require a canonical RUDI stack manifest and explicit
  related.operatorSkillPath containing SKILL.md.
• Install the stack and operator from the same pinned snapshot transactionally;
  preserve the prior install and lock on failure.
• Suppress downloaded dependency/build/index execution unless the user gives
  explicit script authorization.
• Remove stale MCP index entries whenever activation is deferred or fails.
• Preserve existing Registry and npm: install behavior.
• Require the explicit GitHub tree URL plus --force to replace a pinned
  external source.

Risk Tier

High. This introduces a software supply-chain input boundary and durable
source provenance. The implementation fails closed, bounds remote traversal,
pins immutable source, verifies installed content and modes, and prevents
implicit downloaded-code execution.

SWE Checklist

• Phase 0: Baseline and manual lookup
• Phase 1: Scope lock
• Phase 2: Complete red-command ledger; the compliance record discloses a
  process gap for some independent-review remediations
• Phase 3: Implementation
• Phase 4: Green tests and refactor
• Phase 5: Full authorized verification
• Phase 6: Commit, PR, CI, acceptance, and final closeout

Full checklist: docs/swe-compliance/2026-08-29-github-tree-install.md

Acceptance Criteria

• Exact compatible public GitHub tree URLs resolve and install at a pinned SHA.
• The declared operator skill installs from that same SHA and projects safely.
• Invalid, ambiguous, oversized, incomplete, or unsafe source content fails
  before a partial install becomes active.
• Existing installs and locks roll back on stack/operator validation failure.
• Downloaded code does not build, install Python requirements, or enter the MCP
  tool index without explicit authorization.
• Lock verification detects content and executable-mode tampering.
• Pinned external packages are not silently updated through Registry update
  flows.
• Targeted tests, full suite, deterministic build, debt scan, package boundary,
  isolated smoke, CI, and independent review are green.

Notes / Out Of Scope

• Private repository authentication and non-GitHub hosts
• Repository-root shorthand and arbitrary non-RUDI repositories
• Publishing a new public fixture or changing the Registry contract
• CLI release, deployment, or installing the candidate on user machines
• Worktree deletion or cleanup without a separate closeout and approval gate

[rudijetson]

SWE checklist: docs/swe-compliance/2026-08-29-github-tree-install.md

Scope is locked to public GitHub tree installation, pinned provenance, required
operator-skill installation, safe activation/update behavior, tests/docs, and
the generated CLI bundle. The task branch is
chore/34-public-github-tree-install; release, deployment, user-machine
installation, and worktree cleanup remain out of scope.

[rudijetson]

Delivery closure

• Pull request Install compatible RUDI stacks from public GitHub tree URLs #35 merged as 6c6bb1dbda35bc257120113119aad6c7b79575cf.
• Required GitHub Actions quality check passed.
• Issue Install compatible RUDI stacks from public GitHub tree URLs #34 was closed by the merged PR.
• The exact task worktree is clean, conflict-free, zero commits ahead of merged
  origin/main, and one merge commit behind it.
• Repo Steward final receipt: github-tree-install-20260829-final, version 3,
  state archive_eligible, classification archive_candidate.
• Cleanup eligibility passed, but no cleanup approval was recorded and no local
  or remote branch/worktree deletion was performed.
• Release, deployment, fixture publication, and installation on user machines
  remain outside this issue.