feat(skills): add karpathy-guidelines and last30days as pointer entries (#46)

## Summary

Add two community skills as **metadata-only pointer entries**, following
ADR-038 (market stores only `entry.json` + source pointer for
third-party content; no source vendored into the repo).

| id | upstream | stewardship | license | redistribution |
|----|----------|-------------|---------|----------------|
| `karpathy-guidelines` |
[multica-ai/andrej-karpathy-skills](https://github.com/multica-ai/andrej-karpathy-skills)
| community | MIT | allowed |
| `last30days` |
[mvanhorn/last30days-skill](https://github.com/mvanhorn/last30days-skill)
| community | MIT | allowed |

## Changes

- `skills/karpathy-guidelines/entry.json` — pointer to
`skills/karpathy-guidelines` on branch `main`
- `skills/last30days/entry.json` — pointer to `skills/last30days` on
branch `main`
- `manifest.json` — `totalSkills` 45 → 47, `lastUpdated` bumped

## ADR-038 compliance

- No upstream source tree vendored; only `entry.json` metadata +
`source` git pointer.
- Required fields present: `stewardship` / `license` / `redistribution`.
- Both upstreams are MIT and `redistribution: allowed`; content is
fetched from upstream at install time.

## Testing

- Validated both `entry.json` files are well-formed JSON.
- `source.path` usage matches existing precedent (e.g. `minimax-tts`,
`minimax-image-gen`).

manifest.json

@@ -27,8 +27,8 @@
   },
   "stats": {
     "totalAgents": 1,
-    "totalSkills": 48,
-    "lastUpdated": "2026-07-09"
+    "totalSkills": 50,
+    "lastUpdated": "2026-07-11"
   },
   "features": [
     "curated-index",