fix(repo): Harden catalog sync and release integrity

Tighten the repo-state automation so canonical bot commits remain
predictable while leaving main clean after each sync.

Make the public catalog UI more honest by hiding dev-only sync,
turning stars into explicit browser-local saves, aligning risk types,
and removing hardcoded catalog counts.

Add shared public asset URL helpers, risk suggestion plumbing,
safer unpack/sync guards, and CI coverage gates so release and
maintainer workflows catch drift earlier.

tools/scripts/sync_microsoft_skills.py

@@ -207,6 +207,9 @@ def find_plugin_skills(source_dir: Path, already_synced_names: set):
         skill_dir = skill_file.parent
         skill_name = skill_dir.name
 
+        if not is_safe_regular_file(skill_file, source_dir):
+            continue
+
         if skill_name not in already_synced_names:
             results.append({
                 "relative_path": Path("plugins") / skill_name,