feat(lib): vendor-skills helper, five MengTo scroll skills pinned

lib/vendor-skills.sh: vendor_pinned_skills <lock-key> [refresh], list or
dict lock shapes, lock read via python argv, traversal and charset guard
on lock values, VENDOR_BASE_URL honoured only as file:// (hermetic suite),
per-file tmp+mv, refresh skips a skill never installed. install-plugins.sh
Step 8e and update-all.sh 7.3 call it for agent-skills and mengto-skills.
Vendored at a965851: scroll-world-storytelling, build-threejs-scroll-worlds
(+5 references), scroll-scrubbed-visual-sequence, scroll-scrubbed-word-
reveal, scroll-progress-timeline; text files only. Registered in link.sh,
.gitignore, toggle-external, profile.sh and the design/web/web-full/full
profiles, which also list site-motion (personal). Suite: 8 cases.

lib/profile.sh

@@ -82,6 +82,11 @@ MANAGED_EXTERNALS=(
   observability-and-instrumentation
   deprecation-and-migration
   ci-cd-and-automation
+  scroll-world-storytelling
+  build-threejs-scroll-worlds
+  scroll-scrubbed-visual-sequence
+  scroll-scrubbed-word-reveal
+  scroll-progress-timeline
 )
 
 # MCP servers that are toggle-managed by `set`, both ways (enable AND
@@ -761,7 +766,10 @@ NOTE:
   (emil-design-eng, frontend-design, design-motion-principles, impeccable,
   the five 21st design skills, the agent-skills trio
   observability-and-instrumentation/deprecation-and-migration/
-  ci-cd-and-automation). Anything outside those allowlists stays
+  ci-cd-and-automation, the five Mengto scroll skills
+  scroll-world-storytelling/build-threejs-scroll-worlds/
+  scroll-scrubbed-visual-sequence/scroll-scrubbed-word-reveal/
+  scroll-progress-timeline). Anything outside those allowlists stays
   advisory — run "claude plugin enable|disable" or
   "bash lib/toggle-external.sh enable|disable <tool>" yourself.
 EOF