feat: 市场转型为元数据注册表（pointer entry + 许可署名） (#33)

## 概述 / Summary

把 market 从「内容仓库」转型为「元数据注册表」的仓库侧改动，配合客户端 PR

[desirecore/desirecore#919](https://github.com/desirecore/desirecore/pull/919)
与

[ADR-038](https://github.com/desirecore/desirecore-docs/blob/main/技术/决策/ADR-038-市场元数据注册表与两层技能模型.md)。

原则：market 只放元数据、不放第三方内容；内置技能仍 bundled（有界例外）。每条第三方条目用
`entry.json`（元数据 + `source` 指针），正文放各自源仓库、安装时按需获取。

## 改动 / Changes

### S10 — minimax 迁出为官方独立仓库
- `minimax-image-gen` / `minimax-tts`（均 `author=desirecore`）迁至新建的官方开源仓库

**[desirecore/skills-minimax](https://github.com/desirecore/skills-minimax)**（MIT，monorepo，
  一仓多技能）。
- market 改用 `skills/<id>/entry.json` 的 pointer 引用（`source.path`
指入子目录，`ref` 锁定
  commit `6e39eee`），删除内联 `SKILL.md`。

### S11 — 许可署名合规
- 新增根 `LICENSE`（MIT）与 `THIRD_PARTY_NOTICES.md`。
- 标注 Anthropic **docx/pdf/pptx/xlsx 为 source-available（非开源、仅供演示参考）**、
frontend-design 等为 Apache-2.0；每条 entry 的 `license`/`redistribution`
为单条真相源。

### S12 — 外部技能改为纯 pointer（取代 #32 的 vendoring）
- 把 [#32](https://github.com/desirecore/market/pull/32) 的 10 个外部技能写成
`entry.json`
  pointer（**不再 vendor 上游源码**）：
  - MIT/MIT-0 → `partner`/`community` + `allowed`
  - 无声明许可（meituan / netease）→ `pointer` + `source-pointer-only`
  - luckin 打包产物 → `pointer` + `verify-package-terms`（`source.kind=zip`）

## 说明 / Notes

- 外部条目的 `name`/`category` 为基于上游 URL 的合理初值，后续可随上游元数据完善。
- 客户端（#919）已支持 `entry.json` 读/装与体积守护栏；本 PR 合并后，主仓库需重新
  `npm run sync-market` 重打包 `defaults/market.zip`。

> 注：`follow-builders`（zarazhangrui/follow-builders, MIT）是 #32
`external-skills.json` 外部技能集合中的一员，属本次迁移范畴，非额外引入。

Co-authored-by: yi-ge <jackyoncode@gmail.com>

THIRD_PARTY_NOTICES.md

@@ -0,0 +1,32 @@
+# Third-Party Notices
+
+This repository's own content (DesireCore-authored skills and metadata) is licensed
+under the MIT License (see `LICENSE`). Some bundled skills are derived from or
+authored by third parties and are governed by their own terms, noted below. The
+`license` / `redistribution` fields on each entry are the source of truth per skill.
+
+## Anthropic skills (`anthropics/skills`)
+
+The following skills are **source-available, NOT open source**. Per Anthropic's
+`anthropics/skills` README they are provided for demonstration and educational
+purposes only. They are included here as reference implementations; verify
+Anthropic's terms before redistribution or production use.
+
+- `skills/docx`
+- `skills/pdf`
+- `skills/pptx`
+- `skills/xlsx`
+
+Other Anthropic-authored skills in this repository are licensed under
+**Apache-2.0** (e.g. `skills/frontend-design`); the Apache-2.0 license and any
+required NOTICE attribution apply to those skills.
+
+Upstream: https://github.com/anthropics/skills
+
+## External / pointer skills
+
+Skills described only by an `entry.json` pointer (no vendored source) are
+maintained by their respective upstreams and governed by each upstream's license.
+See the `license` and `redistribution` fields in each `skills/<id>/entry.json`.
+Entries with `redistribution: source-pointer-only` or `verify-package-terms` are
+not redistributed here; their content is fetched from the upstream at install time.