Install compatible RUDI stacks from public GitHub tree URLs

[rudijetson]

Summary

• accept exact public GitHub tree URLs for compatible RUDI stack directories
• resolve mutable refs to an immutable commit and preserve source/content-mode
  provenance
• install the required operator skill from the same pinned snapshot with
  transactional rollback
• suppress downloaded build/dependency/index execution by default and remove
  stale MCP index entries until authorized activation succeeds
• define explicit pinned-source replacement/update behavior and regenerate the
  tracked CLI bundle

Issue

Fixes #34

SWE Checklist

docs/swe-compliance/2026-08-29-github-tree-install.md

Risk

• Tier: High
• Rationale: Adds a software supply-chain input boundary and durable source
  provenance. Inputs are fail-closed, bounded, commit-pinned, mode-aware, and
  prevented from implicit execution.
• Rollback: Revert commits 77dc203 and e9f94b2; the documentation commit
  is independently reversible. No schema or user-data migration is required.

Proof

• Red/green boundary coverage and the disclosed red-ledger process gap are
  recorded in the checklist.
• Final targeted install-policy suite: 19/19 passed; earlier complete feature
  suite: 33/33 passed.
• Full suite: 716 tests across 43 suites passed, 0 failed.
• Isolated stack-plus-operator integration: 1/1 passed.
• pnpm build: passed for both bundles.
• Canonical edited-source debt scans: 0 findings.
• npm pack --dry-run: passed with six intended publish files.
• git diff --check: passed.
• Live public rejection smoke failed before mutation when the selected source
  lacked related.operatorSkillPath.

Independent Review

A fresh-context review identified and drove remediation for path/ref ambiguity,
partial traversal, source-snapshot mixing, executable-mode provenance,
transaction rollback, command containment, downloaded-code activation, and
stale MCP index behavior. Final review reported no blocking findings.

Accepted Debt

None in the edited source. A broad src scan reported seven pre-existing
orphan warnings outside the edited-file scope; the focused edited-file scan is
clean.

Proof Gaps

• No already-public compatible fixture currently declares
  related.operatorSkillPath; successful installation is covered by the
  isolated integration, while a real public rejection path was exercised.
• This PR does not publish a fixture, release the CLI, deploy it, or install it
  on user machines.

Branch Cleanup

Final worktree closeout must be recorded after merge and before any separately
authorized branch/worktree cleanup. This PR itself performs no cleanup.