fix(plugin): respect marketplace component boundaries

[christso]

Summary

Skills-only repositories no longer leak their development hooks, GitHub configuration, or MCP servers into consumer workspaces. AllAgents now reads both Copilot and Claude marketplace manifests and honors the component kinds declared by a strict: false entry, including when the repository is installed directly or fetched through another marketplace.

Before this change, source: "./" made the whole repository look like plugin content, so .github/hooks could be interpreted as distributable configuration. After this change, a root source can remain a plugin while skills: ["./skills/"] is the only exposed component; top-level hooks/ remains available to conventional or explicitly hook-bearing plugins.

The boundary is enforced in the normal file copier, Codex hook aggregation, MCP discovery, skill scanning, and legacy user-hook relocation. Custom marketplace component paths are parsed but not remapped yet; this PR applies the declared component-kind boundary to AllAgents' conventional root directories.

Related: WiseTechGlobal/mcp-ediprod#448

Validation

• bun run build
• bun run typecheck
• bun run lint
• bun test — 1,347 passed, 5 skipped
• bun run test:e2e — 117 passed, 4 skipped

Manual E2E:

1. Cloned WiseTechGlobal/mcp-ediprod into a temporary directory.
2. Set its root marketplace entry to strict: false with skills: ["./skills/"].
3. Configured a temporary Copilot workspace with the cloned repository as a direct plugin source.
4. Ran the built CLI with dist/index.js update.
5. Verified all five skills appeared under .github/skills, while .github/hooks, .github/plugin, and .copilot/mcp-config.json were absent.