New skill

Upload a gzipped tarball containing skill.json at the root, plus the files it lists. Names are validated; absolute paths and traversal are rejected.