feat(install): accept GitHub skill file URLs

[WilliamK112]

apm-spec-waiver: CLI-only URL normalization reuses existing git and skills manifest semantics.

Closes #1970

Summary

• Normalize GitHub blob URLs and raw.githubusercontent.com URLs that point at skills/<name>/SKILL.md into repo refs plus an implicit skills subset.
• Apply the implicit skill pin per package, so mixed installs do not leak that skill filter onto unrelated packages.
• Keep malformed GitHub SKILL.md URLs clear by reporting when the file is outside a skills/ directory.
• Add direct parser coverage for URL variants, aggregation, malformed paths, and traversal rejection.

Validation

• uv run --frozen --extra dev pytest tests/unit/install/test_github_skill_url.py tests/unit/install/test_skill_subset_deploy_parity.py tests/unit/test_skill_subset_persistence.py tests/integration/test_pack_install_flow.py::TestValidateAndAddPackagesToApmYml -q -n0 (91 passed)
• uv run --frozen --extra dev ruff check src/apm_cli/commands/install.py src/apm_cli/install/package_resolution.py tests/unit/install/test_github_skill_url.py tests/integration/test_pack_install_flow.py
• uv run --frozen --extra dev ruff format --check src/apm_cli/commands/install.py src/apm_cli/install/package_resolution.py tests/unit/install/test_github_skill_url.py tests/integration/test_pack_install_flow.py
• BASE_REF=origin/main bash tests/spec_conformance/mode_b_detector.sh
• git diff --check origin/main...HEAD

Signed-off-by: WilliamK112 WilliamK112@users.noreply.github.com

[Copilot]

Pull request overview

This PR extends apm install to accept full GitHub file URLs that point to skills/<name>/SKILL.md (from both github.com/.../blob/... and raw.githubusercontent.com/...) by normalizing them into a repo ref plus an implicit per-package skills: subset pin in apm.yml.

Changes:

• Add GitHub SKILL.md URL normalization that derives (repo#ref, skills[]) and produces clearer validation errors for malformed URLs.
• Apply implicit skill subset pins per package during install reference resolution (preventing subset leakage across other packages in the same install).
• Add integration coverage for blob/raw URL normalization, manifest update behavior, non-leakage, and invalid “outside skills/” URLs.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
tests/integration/test_pack_install_flow.py	Adds integration tests covering GitHub blob/raw SKILL.md URL installs and error cases.
src/apm_cli/install/package_resolution.py	Introduces URL parsing/normalization helpers to convert GitHub SKILL.md URLs into repo refs + skill subsets.
src/apm_cli/commands/install.py	Threads per-package implicit skill subsets into _resolve_package_references so subset pins apply only to the intended package(s).

[WilliamK112]

Rebased onto current main and resolved the install/docs conflicts. I also added direct parser tests for aggregation, malformed paths, and percent-encoded traversal rejection. Current focused validation: 91 tests passed; Ruff check/format, the Mode B spec gate, and git diff --check are clean.