Support skills and subagents from user-declared content sources

[williamthorsen]

Problem

Skills and subagents that resolve from a non-library declared source fail loudly as not-yet-supported (the type !== 'rulebook' guard in dependency-resolver.ts, placed upstream of the render pass). #924 wired rulebooks through source resolution; skills and subagents remain blocked. Extend source resolution to them.

Context

The not-yet-supported boundary sits upstream of expandIncludes so the render pass's external-include base could be decided later. Two things block a source-resolved skill/subagent today: the guard, and the deploy pass (sync.ts), which resolves declared skills and subagents from hardcoded library directories rather than through the source resolver.

Proposed solution

Resolve declared skills and subagents through the SourceResolver (declared sources first, then the library), and lift the guard for these two types.

Set each source-resolved artifact's external-include base to its own source root — the directory the resolver searched — mirroring how a library artifact's includes resolve against the library root. A source is structurally a content root (it holds skills/, subagents/, …), so its includes stay within its own tree; a source artifact cannot reach into the library or a sibling source for a partial. This within-source containment is a current-scope rule, not permanent — cross-root includes are tracked in #937.

Thread the include base as a per-artifact value, since different declared artifacts can resolve from different sources — not the per-harness library directory it is today.

Collections stay guarded (narrow the guard to type === 'collection'): a source collection's members: '@library' sentinel would enumerate the library catalog, not the source — an undecided semantic tracked in #938.

Acceptance criteria

Must have

• A skill or subagent that exists only in a declared source (not the committed library) deploys correctly, including its expandIncludes render pass.
• A source-resolved skill/subagent resolves its includes against its own source root; a target outside that root fails out-of-tree.
• A source skill/subagent of the same slug as a library one shadows it (source-first precedence), and ownership-marker retraction stays correct regardless of origin.
• The not-yet-supported guard is narrowed to collections: skills and subagents pass through; a source-resolved collection still fails loudly.
• README source documentation reflects skills and subagents resolving through sources, states the within-source include-containment rule, and drops the not-yet-supported note for them.
• New and modified behavior is covered by tests.