Sync third-party and MCP marketplace plugins

Constraint: Public skills are published only by explicit administrator action unless they are tracked third-party market sources.
Confidence: high
Scope-risk: narrow
Directive: Keep private/internal skills out of the public marketplace and preserve normal incremental market Git history.
Tested: Marketplace validation passed.

plugins/codex/plugins/next-skills/THIRD_PARTY_SOURCE.json

@@ -1,9 +1,9 @@
 {
   "sourceId": "next-skills",
-  "repo": "https://github.com/vercel-labs/next-skills.git",
-  "ref": "main",
-  "commit": "dc1de9caf7612d73f56a8dec3cb1bd6c9ec096b9",
+  "repo": "https://github.com/vercel/next.js.git",
+  "ref": "canary",
+  "commit": "16db9d05442fc1521c02e6690599aa89da0df0ec",
   "adapter": "skill-collection",
   "sourcePath": "skills",
-  "syncedAt": "2026-06-15T08:24:34Z"
+  "syncedAt": "2026-06-24T03:48:19Z"
 }