fix: stamp Skill metadata from release identity

[shushushv]

Summary

• use a reserved 0.0.0-dev value for checked-in official Skill metadata
• derive release versions from the requested stable or prerelease identity
• stamp Skill and package versions only inside isolated prepared source trees
• validate the exact public commit before tag publication
• reject reserved source and snapshot identities from public prerelease inputs

Public diff

• 10 files changed
• 224 insertions, 104 deletions
• adds committed-source preflight coverage and updates release-contract tests

Verification

• public surface scan: 177 files
• generated public tree: 4aeac9d4aea022c9d9f6716a08e0ff6ada223f7d
• generated GitHub review-tree make ci: passed with repository Go toolchain 1.25.12

Provenance

• internal public-source checkpoint: 3caeea615a775dabbb91ac97ff1bf4ab6e53f8d7
• internal development source: 1d7cc6610ca6505226780ebcc13977d41b838cd2
• GitHub base: 6ec931dcc7c166da56f267de87beb32bfdc13487
• synchronization state before preparation: internal-ahead