Sync third-party and MCP marketplace plugins

Constraint: Public skills are published only by explicit administrator action unless they are tracked third-party market sources.
Confidence: high
Scope-risk: narrow
Directive: Keep private/internal skills out of the public marketplace and preserve normal incremental market Git history.
Tested: Marketplace validation passed.

config/external-sources.lock.json

@@ -42,8 +42,8 @@
       "repo": "https://github.com/shadcn-ui/ui.git",
       "ref": "main",
       "adapter": "claude-skill",
-      "commit": "984f4351cb3877fc60726ccec8c4d0bc1631bc0d",
-      "syncedAt": "2026-09-28T10:12:45Z"
+      "commit": "db2db460a26fa84fb65c8d903b213925fbdee9ed",
+      "syncedAt": "2026-09-28T16:00:01Z"
     },
     {
       "id": "frontend-slides",
@@ -130,10 +130,10 @@
       "id": "artemis-automation",
       "pluginName": "artemis-automation",
       "repo": "https://git.playones.com/chenmingxuan/Artemis-Eapil.git",
-      "ref": "v1.2.1",
+      "ref": "v1.2.2",
       "adapter": "claude-skill",
-      "commit": "1dc2b0c6867da5a505e558974bb330743e4c30c6",
-      "syncedAt": "2026-09-28T10:12:45Z"
+      "commit": "e1e26772d91a1e608673d34464212d4361ee1f60",
+      "syncedAt": "2026-09-28T16:00:01Z"
     },
     {
       "id": "embedded-app-pc-debug",
@@ -168,8 +168,8 @@
       "repo": "https://github.com/vercel/next.js.git",
       "ref": "canary",
       "adapter": "skill-collection",
-      "commit": "705a28453296df17c5d269a4248ca36758a6fce2",
-      "syncedAt": "2026-09-28T10:12:45Z"
+      "commit": "3a5205b89de504f88066d267eafaabec0c774b74",
+      "syncedAt": "2026-09-28T16:00:01Z"
     },
     {
       "id": "shuorenhua",