feat: vendor add end-to-end with deterministic lockfile v2

- go-git in-process clone, default-branch/tag resolution, optional token auth
- web-tree URL normalization (github/gitlab) with implied discovery root
- discovery of skills/commands/agents/mcp, lenient frontmatter with warnings
- selection: all by default, --include with missing-entry hard errors
- external/<source>/<type>/ materialization preserving exec bits
- lockfile v2: deterministic JSON, pinned url/ref/rev, inventory, warnings
- offline black-box e2e suite against local fixture git repositories

internal/gitsource/url_test.go

@@ -0,0 +1,35 @@
+package gitsource
+
+import "testing"
+
+func TestNormalizeURL(t *testing.T) {
+	cases := []struct {
+		name, in, wantURL, wantRoot string
+	}{
+		{"github repo", "https://github.com/org/repo", "https://github.com/org/repo.git", ""},
+		{"github tree with subpath", "https://github.com/org/repo/tree/main/skills", "https://github.com/org/repo.git", "skills"},
+		{"github tree nested subpath", "https://github.com/org/repo/tree/main/content/skills", "https://github.com/org/repo.git", "content/skills"},
+		{"github tree no subpath", "https://github.com/org/repo/tree/main", "https://github.com/org/repo.git", ""},
+		{"gitlab tree with subpath", "https://gitlab.com/org/repo/-/tree/main/agents", "https://gitlab.com/org/repo.git", "agents"},
+		{"gitlab plain repo", "https://gitlab.com/org/repo", "https://gitlab.com/org/repo.git", ""},
+		{"already normalized github", "https://github.com/org/repo.git", "https://github.com/org/repo.git", ""},
+		{"ssh url untouched", "git@github.com:org/repo.git", "git@github.com:org/repo.git", ""},
+		{"https url untouched", "https://example.com/repo.git", "https://example.com/repo.git", ""},
+		{"local path untouched", "/tmp/fixture-upstream", "/tmp/fixture-upstream", ""},
+		{"file url stripped", "file:///tmp/fixture-upstream", "/tmp/fixture-upstream", ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			url, root, err := NormalizeURL(tc.in)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if url != tc.wantURL {
+				t.Errorf("url = %q, want %q", url, tc.wantURL)
+			}
+			if root != tc.wantRoot {
+				t.Errorf("root = %q, want %q", root, tc.wantRoot)
+			}
+		})
+	}
+}