Import verified skill archives

AGENTS.md

@@ -5,7 +5,7 @@
 ## Layout
 
 - `skills/<name>/SKILL.md` — one narrowly triggered on-demand behavior.
-- `bin/ink-skills` — dependency-free installer; stdout is TSV, diagnostics stderr.
+- `bin/ink-skills` — POSIX linker/importer; stdout is TSV, diagnostics stderr.
 - `test/install-smoke.sh` — installer contract smoke.
 
 ## Rules
@@ -13,7 +13,8 @@
 - A skill owns reusable judgment, never runtime policy or repeatable mechanics.
 - Ink source and `REQUIREMENTS.md` own host behavior; `toolset` owns external executables.
 - Keep skill names lowercase and hyphenated; directory and frontmatter name must match.
-- The installer only creates symlinks and must refuse collisions. Do not add a registry,
-  network calls, package-manager dependency, prompts, copies, or hidden state.
+- `link` only creates symlinks. `import` may materialize only a caller-supplied,
+  SHA-256-verified local archive in the content-addressed store. Do not add URL,
+  Git, credential, registry, package-manager, prompt, or updater behavior.
 - Run `sh -n bin/ink-skills`, `sh test/install-smoke.sh`, and
   `sh test/skills-smoke.sh` after changes.