Harden fork-aware Firstmate updates

[pranaypratyush]

Summary

• bundle the retained engineering skills with explicit provenance and invocation triggers
• synchronize eligible GitHub forks before guarded local and secondmate updates while preserving non-GitHub behavior and fail-closed preflight
• converge inherited configuration across registered secondmates and verify every vendored skill lock hash deterministically

Validation

• independent Spec review and narrowed Standards re-review passed
• post-rebase range-diff paired all three commits exactly
• updater suite passed
• vendored skill-lock regression passed for all 21 entries
• config and secondmate harness suite passed
• documentation audience, changed-shell syntax, and diff checks passed
• ShellCheck 0.11.0 was unavailable locally