Sync third-party and MCP marketplace plugins

Constraint: Public skills are published only by explicit administrator action unless they are tracked third-party market sources.
Confidence: high
Scope-risk: narrow
Directive: Keep private/internal skills out of the public marketplace and preserve normal incremental market Git history.
Tested: Marketplace validation passed.

config/external-sources.lock.json

@@ -42,8 +42,8 @@
       "repo": "https://github.com/shadcn-ui/ui.git",
       "ref": "main",
       "adapter": "claude-skill",
-      "commit": "295a1f114a138f23b5dfee0e0c6812394dfeb90c",
-      "syncedAt": "2026-10-02T16:00:00Z"
+      "commit": "dba27166ad7b146b2bd840dcfb0a7d0fd95f5c8c",
+      "syncedAt": "2026-10-05T16:00:00Z"
     },
     {
       "id": "frontend-slides",
@@ -78,8 +78,8 @@
       "repo": "https://github.com/hugohe3/ppt-master.git",
       "ref": "main",
       "adapter": "claude-skill",
-      "commit": "44c10ed0bc3a9e1df7a25aa179ae7c26db09469b",
-      "syncedAt": "2026-10-01T16:00:00Z"
+      "commit": "2d72da616cf9fa40d4dcaf59fd4c980ecf534b7d",
+      "syncedAt": "2026-10-05T16:00:00Z"
     },
     {
       "id": "grill-me",
@@ -87,8 +87,8 @@
       "repo": "https://github.com/mattpocock/skills.git",
       "ref": "main",
       "adapter": "skill-collection",
-      "commit": "24fe0ef7737efae15c87225755e9f6f5965e4888",
-      "syncedAt": "2026-10-04T16:00:00Z"
+      "commit": "4588b32ecab9ecc9fc8cc6b6c5e7d675b6004b0d",
+      "syncedAt": "2026-10-05T16:00:00Z"
     },
     {
       "id": "updating-gitea-repositories",
@@ -168,8 +168,8 @@
       "repo": "https://github.com/vercel/next.js.git",
       "ref": "canary",
       "adapter": "skill-collection",
-      "commit": "ba80ee48fc319735151c3ad6d9bb9a8180c9f09e",
-      "syncedAt": "2026-10-04T16:00:00Z"
+      "commit": "41215d77762375b4b5154b12cfbb4372a835f8a0",
+      "syncedAt": "2026-10-05T16:00:00Z"
     },
     {
       "id": "shuorenhua",