fix(skills-init): skip existing Git skills

[Tethys0]

Summary

Fixes #2646.

Make Git skill downloads reentrant across skills-init restarts: a destination that already contains a real, regular SKILL.md is treated as a completed skill and is not downloaded again. This lets a restart continue after another initialization step fails without re-cloning already materialized skills.

Existing destinations are validated before they are accepted: the destination and SKILL.md must not be symbolic links, the destination must be a directory, and SKILL.md must be a regular file. Invalid existing destinations return a clear error rather than being silently accepted.

Scope

• Git ref fetches only.
• OCI and S3 destinations are unchanged.
• No new dependencies or API changes.

Testing

• go test -race ./core/internal/skillsinit (40 passed)
• go vet ./core/internal/skillsinit
• gofmt and git diff --check
• Independent final code review: passed with no blocking security or logic findings.

[EItanya]

What if we just make the skills download code reentrant safe? We can just check for the presence of an existing skill, and if it exists don't download the new one

[Tethys0]

Thanks — I adopted the reentrant-download approach. The updated implementation now skips a destination only when it already contains a real SKILL.md; invalid or symlinked destinations are rejected rather than treated as successful downloads.

Added focused coverage for an existing skill, an incomplete destination, and symlinked paths. Verified with go test -race ./core/internal/skillsinit and go vet ./core/internal/skillsinit.

This force-update also replaces the earlier staging/replacement implementation.