fix(import): detect installer package collections

[santosli]

Summary

• accept v3 installer pluginName as bounded package metadata instead of treating it as a child skill identity
• group validated HyperFrames installer children by their normalized GitHub source while retaining strict entry/path/candidate matching
• document the lockfile matching boundary and add the HyperFrames runtime-location regression

Root cause

HyperFrames entries share pluginName=core-skills; the prior parser rejected that package identifier because it did not equal an individual skill name.

Verification

• cargo fmt --check
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo test --offline
• npm test (278/278)
• npm --workspace apps/desktop run build
• npm audit --audit-level=high
• cargo audit (18 repository-policy allowed warnings)
• git diff --check
• aggregate-only local scan: HyperFrames source yields 1 Installed Source Collection, 9 children, 0 duplicate standalone groups