feat: 新增外部条目上游健康检查与每周巡检工作流 (#188)

## 背景
外部条目只存上游指针，上游仓库被删除、分支被重写或技能目录移动时，客户端安装会静默失败，目前没有任何机制能发现（例如
`dingtalk-cli` 的上游已 404，见修复 PR）。

## 变更
- **`scripts/catalog/check_upstream_health.py`**：只读，逐个检查
`skills/`、`agents/`、`teams/` 下的 `entry.json`：
- 失效（退出码 1）：`gone` 上游不存在 · `bad-branch` 分支不存在 · `bad-ref` 固定提交无法获取 ·
`bad-path` `source.path`、根 `SKILL.md` 或 children 路径在分支最新提交下缺失
- 提示：`unreachable` 网络错误（不等于失效）· `new-skill` 集合有未声明子技能（发现规则直接复用
`gen-collection-children.py` 的 `discover_children`，两者结论一致）· `outdated`
固定 ref 落后于分支 · `unpinned` 未锁定 ref
  - 只稀疏检出 `SKILL.md`，39 个条目本地全量运行约 12 秒
- **`scripts/catalog/test_check_upstream_health.py`**：9 个基于本地 Git
仓库的单测，已加入 `i18n-validate.yml`。
- **`.github/workflows/upstream-health.yml`**：每周一 01:23 UTC 运行（可手动触发），仅在
`desirecore/market` 运行：
- 报告写入 Job Summary，并维护唯一一个带 `upstream-health` 标签的
Issue：有待处理项时创建或更新，全部正常时评论并关闭
  - 有失效条目时任务标红
- 权限仅 `contents: read` + `issues: write`，**不改写任何目录文件**；修复与 `source.ref`
更新仍通过评审 PR（与固定 ref 的审查语义一致）
- README 中英文补充用法。

## 当前主干的检查结果
- 失效 1：`dingtalk-cli`（已有修复 PR）
- 未声明子技能 3：`khazix-skills`、`marketingskills`、`mattpocock-skills`
- 可更新 21 个，未锁定 1 个
- `amap-jsapi-skill`、`luckin-my-coffee` 在本地因代理显示 `unreachable`，需要 CI
环境确认

## 验证
```
uv run scripts/catalog/test_check_upstream_health.py   # Ran 9 tests OK
uv run scripts/catalog/check_upstream_health.py        # 如上
uv run scripts/i18n/validate-i18n.py                   # 0 error(s)
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_0191D9g1FhRQzEGTefUn6mTb

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Yige <a@wyr.me>

README.md

@@ -209,6 +209,7 @@ uv run scripts/i18n/translate.py --check skills/web-access
 uv run scripts/i18n/test_validate_i18n.py
 uv run scripts/catalog/test_validate_catalog_metadata.py
 uv run scripts/catalog/test_collection_generator.py
+uv run scripts/catalog/test_check_upstream_health.py
 ```
 
 Passing a skill path narrows skill-body validation, but market-level and sidecar checks still run. Choose the relevant test file for your change rather than treating every documentation edit as a reason to run all test suites.
@@ -221,10 +222,16 @@ uv run scripts/gen-collection-children.py --check
 
 # Optional source-URL availability checks in addition to normal validation.
 uv run scripts/i18n/validate-i18n.py --online
+
+# Report deleted upstreams, missing branches or pinned refs, moved skill paths,
+# undeclared collection children, and available updates for every external entry.
+uv run scripts/catalog/check_upstream_health.py
 ```
 
 Collection checking requires Git and network access. Mutable collections are reported and skipped because their generated inventory is not reproducible. Omitting `--check` runs the generator in write mode; review both the regenerated children and the corresponding sidecar facts before committing.
 
+The upstream health check is read-only and exits non-zero when an entry is `gone` or has a `bad-branch`, `bad-ref`, or `bad-path`. `unreachable` is a network error, not a confirmed failure. The [upstream health workflow](.github/workflows/upstream-health.yml) runs it weekly and keeps one `upstream-health` issue current; fixes and `source.ref` bumps still go through reviewed PRs.
+
 The [validation workflow](.github/workflows/i18n-validate.yml) is the source of truth for CI. It detects relevant paths and can skip catalog validation for documentation-only changes. A green skipped job is not evidence that Markdown links or bilingual documentation were checked; review those separately.
 
 ## Security and trust