Define where generated/imported/learned skills live and how they're identified. Clear separation between curated, generated, and imported skill content.

Policy covers:

• Curated vs generated vs imported placement
• Provenance metadata requirements
• Validator behavior for optional/generated directories
• What is publishable vs local-only

GitHub #422