When skills-lock.json is out of date, npx skills experimental_install mutates the lockfile, and git diff --exit-code fails the entire setup step. This blocks Copilot from working at all, when it should degrade gracefully.

• Graceful recovery on dirty worktree: Instead of failing, detect the dirty state, delete .agents/skills (stale external skills), revert all changes, and emit a ::warning:: annotation. Local skills (tracked in git) are restored by git checkout .; gitignored external skills stay removed.
• Add GIT_CONFIG_* env vars: Set core.autocrlf=false per the usethis-skills-external-install skill docs to produce reproducible hashes, reducing false lockfile diffs from the skills CLI bug.

- name: Install external agent skills
  env:
      GIT_CONFIG_COUNT: "1"
      GIT_CONFIG_KEY_0: core.autocrlf
      GIT_CONFIG_VALUE_0: "false"
  run: |
      npx skills experimental_install
      if ! git diff --exit-code --quiet; then
          echo "::warning::skills-lock.json is out of date. Removing installed skills and reverting changes."
          rm -rf .agents/skills
          git checkout .
      fi