feat(skills): vendor agent-skills trio at a pinned commit, emil precedent

observability-and-instrumentation, deprecation-and-migration,
ci-cd-and-automation from addyosmani/agent-skills 2686b620, curl'd into
skills-external/<name>/ by install-plugins.sh Step 8e (tmp+mv), refreshed
by update-all.sh 7.3, symlinked by link.sh, registered in toggle-external,
profile.sh and the full/backend/dev profiles. Pin read from the lock via
argv, never hardcoded. Case 2 of the 6-repo review, BDR-102.

.gitignore

@@ -65,6 +65,9 @@ skills/ios-sync
 skills/design-motion-principles
 skills/emil-design-eng
 skills/frontend-design
+skills/ci-cd-and-automation
+skills/deprecation-and-migration
+skills/observability-and-instrumentation
 
 # Impeccable — NOT a symlink: `impeccable skills install --scope=global`
 # writes the skill dir (and its ~15 MB engine binary) straight in through the
@@ -177,6 +180,15 @@ skills-external/frontend-design/
 # an edit. The source is always re-fetched, so no offline copy is needed.
 skills-external/emil-design-eng/
 
+# Agent Skills trio (addyosmani/agent-skills) — machine-owned, curl'd at the
+# commit pinned in plugins.lock.json ("agent-skills" entry) by
+# install-plugins.sh Step 8e (when absent) and re-fetched at the SAME commit
+# by update-all.sh. Not vendored: this is a pin, not a tracked snapshot —
+# bump the commit deliberately to pick up an upstream edit.
+skills-external/observability-and-instrumentation/
+skills-external/deprecation-and-migration/
+skills-external/ci-cd-and-automation/
+
 # 21st.dev skill pack — machine-owned: `21st skills install` output, staged by
 # install-plugins.sh Step 8.7 (the installer refuses to write through the
 # ~/.claude/skills symlink, so it runs under a throwaway HOME and the skills