Sync third-party and MCP marketplace plugins

Constraint: Public skills are published only by explicit administrator action unless they are tracked third-party market sources.
Confidence: high
Scope-risk: narrow
Directive: Keep private/internal skills out of the public marketplace and preserve normal incremental market Git history.
Tested: Marketplace validation passed.

config/external-sources.lock.json

@@ -24,8 +24,8 @@
       "repo": "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill.git",
       "ref": "main",
       "adapter": "claude-skill",
-      "commit": "4baa399d00da806f83ed93652172f66943205153",
-      "syncedAt": "2026-07-05T16:00:01Z"
+      "commit": "12b486b22e67f5d887962ef8351c1ac863bfaeb9",
+      "syncedAt": "2026-07-06T16:00:00Z"
     },
     {
       "id": "caveman",
@@ -42,8 +42,8 @@
       "repo": "https://github.com/shadcn-ui/ui.git",
       "ref": "main",
       "adapter": "claude-skill",
-      "commit": "d0fae528221011f75a8c64a917073904c2847493",
-      "syncedAt": "2026-07-03T16:00:00Z"
+      "commit": "d8ace420baa5c8a1abccd75e52570f2a232f193d",
+      "syncedAt": "2026-07-06T16:00:00Z"
     },
     {
       "id": "frontend-slides",
@@ -87,8 +87,8 @@
       "repo": "https://github.com/vercel/next.js.git",
       "ref": "canary",
       "adapter": "skill-collection",
-      "commit": "00598045032a0e5b313de7b6ef0af60ed9390c2a",
-      "syncedAt": "2026-07-05T16:00:01Z"
+      "commit": "6065bf6fcfc48484634dc3708c080a27c5684e5d",
+      "syncedAt": "2026-07-06T16:00:00Z"
     }
   ]
 }