fix: preserve URL skill filters and restore nested Git skills

[quuu]

Summary

Fixes #2426. Fixes #2429.

+#ref@skill survives GitHub/GitLab/SSH URL parsing
+lock restore uses update's full-depth rule for unaddressable nested Git paths

Evidence

Before: 12 new URL/restore regressions failed on main. After: 154 focused tests pass; manual URL parsing and built CLI install/delete/restore pass. Type check, formatting and build pass. Full suite: 954 pass, one TTY test fails identically on unchanged main.

Merge Danger

Two-way door; scope is source parsing and project lock restore. Full-depth discovery stays limited to sources whose locked path cannot be appended to the clone URL. Existing hash formats are unchanged.

[vercel-agent-factory]

@quuu — bug-fix candidate.

• Fix: Restores skill-name filters dropped during GitHub/GitLab/SSH URL parsing, and fixes lock restore for nested Git skills needing full-depth search.
• Tests: Added regression coverage in source-parser.test.ts for fragment skill filters.
• CI: pending (head ec28733f).