Submit a skill

Every submission runs the full pipeline: pinned to a commit, validated, license-classified, security-scanned and quality-judged — then a human approves it. Nothing unscanned is ever served.