feat(lib): vendor-skills helper, five MengTo scroll skills pinned

lib/vendor-skills.sh: vendor_pinned_skills <lock-key> [refresh], list or
dict lock shapes, lock read via python argv, traversal and charset guard
on lock values, VENDOR_BASE_URL honoured only as file:// (hermetic suite),
per-file tmp+mv, refresh skips a skill never installed. install-plugins.sh
Step 8e and update-all.sh 7.3 call it for agent-skills and mengto-skills.
Vendored at a965851: scroll-world-storytelling, build-threejs-scroll-worlds
(+5 references), scroll-scrubbed-visual-sequence, scroll-scrubbed-word-
reveal, scroll-progress-timeline; text files only. Registered in link.sh,
.gitignore, toggle-external, profile.sh and the design/web/web-full/full
profiles, which also list site-motion (personal). Suite: 8 cases.

lib/profiles/full.profile

@@ -86,6 +86,11 @@ impeccable                        external
 observability-and-instrumentation  external
 deprecation-and-migration          external
 ci-cd-and-automation               external
+scroll-world-storytelling          external
+build-threejs-scroll-worlds        external
+scroll-scrubbed-visual-sequence    external
+scroll-scrubbed-word-reveal        external
+scroll-progress-timeline           external
 ui-ux-pro-max                     plugin@ui-ux-pro-max-skill
 # pr-review-toolkit REMOVED from full (audit 2026-07-02 #12): heaviest
 # single plugin cost (~2.2k tokens of agent descriptions/session), useful
@@ -99,6 +104,9 @@ ui-ux-pro-max                     plugin@ui-ux-pro-max-skill
 21st-cli-use                      external
 21st-ai                           external
 
+# Personal: motion implementation companion (skills/site-motion)
+site-motion                       personal
+
 # === CLIs (advisory) =================================================
 21st                              cli
 ctx7                              cli