Sync third-party and MCP marketplace plugins

Constraint: Public skills are published only by explicit administrator action unless they are tracked third-party market sources.
Confidence: high
Scope-risk: narrow
Directive: Keep private/internal skills out of the public marketplace and preserve normal incremental market Git history.
Tested: Marketplace validation passed.

config/external-sources.lock.json

@@ -114,8 +114,8 @@
       "repo": "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill.git",
       "ref": "main",
       "adapter": "claude-skill",
-      "commit": "28b3b8dee8c976df4fa3e94aed4e092ad43fcb03",
-      "syncedAt": "2026-10-26T16:00:00Z"
+      "commit": "9a3f14f7423037ccb8feeb4fee7482291b9c820e",
+      "syncedAt": "2026-10-31T16:00:01Z"
     },
     {
       "id": "superpowers-zh",
@@ -150,8 +150,8 @@
       "repo": "https://github.com/shadcn-ui/ui.git",
       "ref": "main",
       "adapter": "claude-skill",
-      "commit": "b8d7baa15b1dca5716f13153e63795fc3d741f6b",
-      "syncedAt": "2026-10-30T16:00:00Z"
+      "commit": "24a16429815cc4d691f38b49d0f4ffc11a9daef4",
+      "syncedAt": "2026-10-31T16:00:01Z"
     },
     {
       "id": "frontend-slides",
@@ -195,8 +195,8 @@
       "repo": "https://github.com/mattpocock/skills.git",
       "ref": "main",
       "adapter": "skill-collection",
-      "commit": "a496f5513d4a4cf889bc48e189e579f4b0bdf6aa",
-      "syncedAt": "2026-10-29T16:00:00Z"
+      "commit": "4ae2317ddb22b046e26455e4f9c9b3aaaf62212d",
+      "syncedAt": "2026-10-31T16:00:01Z"
     },
     {
       "id": "updating-gitea-repositories",
@@ -267,8 +267,8 @@
       "repo": "https://github.com/vercel/next.js.git",
       "ref": "canary",
       "adapter": "skill-collection",
-      "commit": "7571895249a22086367a12ddec90fae97bac067d",
-      "syncedAt": "2026-10-30T16:00:00Z"
+      "commit": "fac5fc87df2b60169189ac6dcba3142854124371",
+      "syncedAt": "2026-10-31T16:00:01Z"
     },
     {
       "id": "shuorenhua",