feat(web): skill detail reads and edits SKILL.md over the asset git remote (CL-8516)

[TheGreatAxios]

Summary

• /skills/<name> now reads and edits a skill's SKILL.md over its own asset git remote (assets/skill/<name>.git), the same smart-HTTP path agent/workflow source already uses — no new hub routes.
• Read: a useQuery mints a short-lived can_read token, fetches SKILL.md off main, and revokes the token. A missing file or a fresh asset with no commits both render an empty editor rather than an error.
• Write: a textarea with a Save button, disabled until the draft differs from the last read, pushes { "SKILL.md": <content> } through a useMutation with a can_read+can_push token, then invalidates the read query. Toasts report success/failure.
• Pulled the mint/use/revoke token dance into a shared git-token.ts helper (withGitToken), and refactored agent-source-read.ts's own copy onto it rather than adding a third copy for skills.
• Added fetchSourceFileOrEmpty to git-fetch.ts, which treats a missing main ref or missing file as "" instead of throwing (the existing fetchSourceFile is untouched for its other callers).
• Deleted the tombstone copy in skill-detail-page.tsx and the dead "no stock route" explanation it depended on.

Test plan

• bunx tsc -p apps/web --noEmit
• bun run lint
• bun run fmt
• cd apps/web && bun run build
• cd apps/web && bun test ./src
• Manual click-through against a running hub (not verified — dev stack wasn't started for this task)

[linear-code]

CL-8516