Add scan_repo_tree_for_skills and scan_skills_from_tree functions that
traverse git objects directly instead of filesystem, enabling skill
discovery in bare repositories created via git2::Repository::init_bare.
- Change deduplication key from slug to {repo_id}+{blob_hash}
- Keep latest version by commit_sha when duplicates found
- Use git2 to open repos and get correct workdir and commit_sha
- Fix case-insensitive SKILL.md detection in scanner