Sync third-party and MCP marketplace plugins

Constraint: Public skills are published only by explicit administrator action unless they are tracked third-party market sources.
Confidence: high
Scope-risk: narrow
Directive: Keep private/internal skills out of the public marketplace and preserve normal incremental market Git history.
Tested: Marketplace validation passed.

config/external-sources.lock.json

@@ -105,8 +105,8 @@
       "repo": "https://github.com/hugohe3/ppt-master.git",
       "ref": "main",
       "adapter": "claude-skill",
-      "commit": "a4f5487dc930ba22f7002d775f49c81f47210960",
-      "syncedAt": "2026-09-08T16:00:01Z"
+      "commit": "64b65839c7f8096a534c872c03d688a2b2491c8f",
+      "syncedAt": "2026-09-09T16:00:00Z"
     },
     {
       "id": "grill-me",
@@ -141,8 +141,8 @@
       "repo": "https://github.com/vercel/next.js.git",
       "ref": "canary",
       "adapter": "skill-collection",
-      "commit": "4cb547213b5303b7f01675a7502b84ce960fd19e",
-      "syncedAt": "2026-09-09T04:01:45Z"
+      "commit": "e0966df11438b1f82e06d6f650a2a044b84457c3",
+      "syncedAt": "2026-09-09T16:00:00Z"
     },
     {
       "id": "shuorenhua",