feat(skills): add karpathy-guidelines and last30days as pointer entries (#46)

## Summary

Add two community skills as **metadata-only pointer entries**, following
ADR-038 (market stores only `entry.json` + source pointer for
third-party content; no source vendored into the repo).

| id | upstream | stewardship | license | redistribution |
|----|----------|-------------|---------|----------------|
| `karpathy-guidelines` |
[multica-ai/andrej-karpathy-skills](https://github.com/multica-ai/andrej-karpathy-skills)
| community | MIT | allowed |
| `last30days` |
[mvanhorn/last30days-skill](https://github.com/mvanhorn/last30days-skill)
| community | MIT | allowed |

## Changes

- `skills/karpathy-guidelines/entry.json` — pointer to
`skills/karpathy-guidelines` on branch `main`
- `skills/last30days/entry.json` — pointer to `skills/last30days` on
branch `main`
- `manifest.json` — `totalSkills` 45 → 47, `lastUpdated` bumped

## ADR-038 compliance

- No upstream source tree vendored; only `entry.json` metadata +
`source` git pointer.
- Required fields present: `stewardship` / `license` / `redistribution`.
- Both upstreams are MIT and `redistribution: allowed`; content is
fetched from upstream at install time.

## Testing

- Validated both `entry.json` files are well-formed JSON.
- `source.path` usage matches existing precedent (e.g. `minimax-tts`,
`minimax-image-gen`).

skills/last30days/entry.json

@@ -0,0 +1,28 @@
+{
+  "id": "last30days",
+  "name": "Last 30 Days",
+  "category": "research",
+  "tags": [
+    "research",
+    "trends",
+    "reddit",
+    "youtube",
+    "hacker-news",
+    "web"
+  ],
+  "maintainer": {
+    "name": "Matt Van Horn",
+    "verified": false,
+    "account": "mvanhorn",
+    "url": "https://github.com/mvanhorn/last30days-skill"
+  },
+  "stewardship": "community",
+  "license": "MIT",
+  "redistribution": "allowed",
+  "source": {
+    "kind": "git",
+    "repoUrl": "https://github.com/mvanhorn/last30days-skill.git",
+    "repoBranch": "main",
+    "path": "skills/last30days"
+  }
+}