feat: recursive skill discovery + tree-url type-root folding

- skills are found at any depth under the skills dir, so category-nested
  layouts (skills/<category>/<id>/SKILL.md) vendor correctly; the folder
  basename is the upstream id and the outermost SKILL.md wins over anything
  nested inside a skill folder
- web-tree urls pointing directly at a type directory (.../tree/main/skills)
  now map that directory as the type root instead of nesting it under the
  default layout
- verified against the real github.com/mattpocock/skills repository
  (36 skills across categories; include-selection by basename)

README.md

@@ -53,11 +53,14 @@ agent-lib.lock.json       lockfile v2 — pins every source
 agent-lib vendor add superpowers https://github.com/obra/superpowers/tree/main/skills
 ```
 
-Pasted GitHub/GitLab web-tree URLs are normalized automatically (the tree
-sub-path becomes the discovery root). `--ref <branch-or-tag>` pins a ref; the
+Pasted GitHub/GitLab web-tree URLs are normalized automatically. A URL
+pointing directly at a type directory (e.g. `…/tree/main/skills`) selects
+that directory as the skills root. `--ref <branch-or-tag>` pins a ref; the
 resolved revision is pinned in the lockfile. Discovery understands the four
 standard directories (`skills/`, `commands/`, `agents/`, `mcp/`); skills are
-folders containing `SKILL.md`, commands and agents are flat `.md` files, MCP
+folders containing `SKILL.md` — found at **any depth**, so category-nested
+layouts (`skills/engineering/tdd/SKILL.md`) work too, with the folder's base
+name as the skill id — commands and agents are flat `.md` files, MCP
 fragments are `.yaml`. Everything is read-only scanned — upstream code is
 never executed.