Unify shared context delivery and discover package skills

[TroyHernandez]

Summary

• Preserve native shared instructions while allowing session hooks to omit an identical native source through the opt-in --native-shared flag. Legacy output remains unchanged without the flag.
• Escape all JSON control characters in hook output and unify the project instruction entrypoints.
• Deduplicate project discovery by canonical directory identity without collapsing distinct checkouts of the same package.
• Add zero-dependency skill_manifest() and skill_read() for package and configured-root discovery, provenance, qualified IDs, deterministic precedence, exact retrieval and resource drift checks.
• Support flat and legacy nested skill layouts, folded metadata and explicit roots. Discovery does not register skills, execute instructions or inject bodies into startup context. MD5 is a drift fingerprint, not an authenticity guarantee.
• Move saber's own skill into its package and preserve its license notice. Development version is 0.7.2.5.

Validation

• Exact committed source build and isolated R CMD check --no-manual --no-vignettes: OK.
• 427 offline assertions plus 18 launcher assertions pass.
• Regression coverage includes native identity, JSON escaping, project aliases, metadata, precedence, duplicate IDs, path boundaries, resource drift and legacy layouts.
• Diff whitespace check is clean. Normal installations and active sessions are unchanged.