Feat: enforce agentskills.io `name` slug pattern at ingestion (`ParseManifest`/`index`)

[so0k]

Context

Follow-up from PR #19 review thread (discussion_r3361754518).

The Qodo bot flagged that renderShowResult's footer hint (→ vendor it: skillrig add <name>) claims to be a runnable command, but appends the raw catalog name directly. A name that begins with - or contains spaces would break the suggested command (cobra flag parsing / shell splitting), violating the "footer is a runnable next-step" contract.

PR #19 added consume-side defense-in-depth (running the name through sanitizeTerminal before printing), but the robust place to guarantee the invariant is at ingestion, which is out of scope for that consume-only PR.

The invariant

The agentskills.io spec constrains name to: lowercase letters, numbers and hyphens only, max 64 chars, must not start or end with a hyphen, and no consecutive hyphens (so no spaces, no leading -, no uppercase).

For any spec-conformant origin, the footer skillrig add <name> is therefore always shell/cobra-safe — the leading-dash / space concern only materializes for a non-conformant catalog.

Proposed work

Enforce the slug pattern origin-side so a non-conformant name is rejected at the source rather than papered over on every consumer:

• Validate the name slug pattern in ParseManifest (reject non-conformant names with an errors-as-navigation message stating the rule + offending value).
• Have origin-side index (and lint, when it lands) reject a catalog containing a non-conformant name.
• Keep the single-implementation discipline — one validator, shared by ParseManifest/index/lint (AP-04), not a parallel copy.

This narrows validateSkillName in skillcore from "single path segment" to the full agentskills.io slug rule.

Spec refs

• https://agentskills.io/specification
• https://github.com/agentskills/agentskills/blob/main/docs/specification.mdx

---

Filed as the follow-up promised in #19 (comment).