feat(lib): vendor-skills helper, five MengTo scroll skills pinned

lib/vendor-skills.sh: vendor_pinned_skills <lock-key> [refresh], list or
dict lock shapes, lock read via python argv, traversal and charset guard
on lock values, VENDOR_BASE_URL honoured only as file:// (hermetic suite),
per-file tmp+mv, refresh skips a skill never installed. install-plugins.sh
Step 8e and update-all.sh 7.3 call it for agent-skills and mengto-skills.
Vendored at a965851: scroll-world-storytelling, build-threejs-scroll-worlds
(+5 references), scroll-scrubbed-visual-sequence, scroll-scrubbed-word-
reveal, scroll-progress-timeline; text files only. Registered in link.sh,
.gitignore, toggle-external, profile.sh and the design/web/web-full/full
profiles, which also list site-motion (personal). Suite: 8 cases.

.gitignore

@@ -68,6 +68,11 @@ skills/frontend-design
 skills/ci-cd-and-automation
 skills/deprecation-and-migration
 skills/observability-and-instrumentation
+skills/scroll-world-storytelling
+skills/build-threejs-scroll-worlds
+skills/scroll-scrubbed-visual-sequence
+skills/scroll-scrubbed-word-reveal
+skills/scroll-progress-timeline
 
 # Impeccable — NOT a symlink: `impeccable skills install --scope=global`
 # writes the skill dir (and its ~15 MB engine binary) straight in through the
@@ -189,6 +194,18 @@ skills-external/observability-and-instrumentation/
 skills-external/deprecation-and-migration/
 skills-external/ci-cd-and-automation/
 
+# Mengto scroll-choreography skills (MengTo/Skills) — machine-owned,
+# curl'd at the commit pinned in plugins.lock.json ("mengto-skills" entry)
+# by install-plugins.sh Step 8e (when absent) and re-fetched at the SAME
+# commit by update-all.sh, through the shared lib/vendor-skills.sh helper.
+# Not vendored: this is a pin, not a tracked snapshot — bump the commit
+# deliberately to pick up an upstream edit.
+skills-external/scroll-world-storytelling/
+skills-external/build-threejs-scroll-worlds/
+skills-external/scroll-scrubbed-visual-sequence/
+skills-external/scroll-scrubbed-word-reveal/
+skills-external/scroll-progress-timeline/
+
 # 21st.dev skill pack — machine-owned: `21st skills install` output, staged by
 # install-plugins.sh Step 8.7 (the installer refuses to write through the
 # ~/.claude/skills symlink, so it runs under a throwaway HOME and the skills