Sync third-party and MCP marketplace plugins

Constraint: Public skills are published only by explicit administrator action unless they are tracked third-party market sources.
Confidence: high
Scope-risk: narrow
Directive: Keep private/internal skills out of the public marketplace and preserve normal incremental market Git history.
Tested: Marketplace validation passed.

config/external-sources.lock.json

@@ -42,8 +42,8 @@
       "repo": "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill.git",
       "ref": "main",
       "adapter": "claude-skill",
-      "commit": "7643fd1501eed926a83d106f92190d1a769c6796",
-      "syncedAt": "2026-09-15T09:16:34Z"
+      "commit": "15de38fb70bc80ae9276fa7703b48ae861a672e6",
+      "syncedAt": "2026-09-15T09:51:52Z"
     },
     {
       "id": "caveman",
@@ -130,10 +130,10 @@
       "id": "etunel-role-collaboration",
       "pluginName": "etunel-role-collaboration",
       "repo": "https://git.playones.com/chenmingxuan/EP-Hub-Skill.git",
-      "ref": "v1.0.3",
+      "ref": "v1.0.4",
       "adapter": "claude-skill",
-      "commit": "20c0de9b3829534685d1f931dc0b574c988eec6b",
-      "syncedAt": "2026-09-10T23:40:59Z"
+      "commit": "1d85de4c7c1cd0138d94b211586c9008b28094df",
+      "syncedAt": "2026-09-15T09:51:52Z"
     },
     {
       "id": "hardware-development",