Extract shared skill-download core and add selective download

[xsh310]

What

PR C of the ug skill add interactive-picker stack. It reshapes skills_download.py so the download mechanics become one reusable core, and adds the (still unwired) functions the picker will call in PR D. No behavior changes on any existing path.

Design doc: ug_skill_add_download_interactive_picker_design.md (PR table, row C).

Changes

• SkillRef carries its full location. New catalog/schema fields plus an fqn property, parsed once from the API name in _skill_ref, so a ref is self-contained and can be downloaded on its own.
• Extract _download_refs(refs, roots) -> (written, total), the shared core: collision dedup, overwrite prompt, parallel fetch, write. should_download_skill and _reject_bundle_name_collisions now read the source off the ref (ref.fqn) instead of an explicit location arg, which produces byte-identical messages and lets the core serve a flat, cross-schema set.
• _fetch_bundles keys results by FQN (a securable name is unique only within its schema) and takes its progress-bar label from the caller.
• Rename download_skills to download_skills_from_schema_locations, now calling _download_refs per location and keeping the exact per-location Downloaded k/n from <location> summary.
• Add get_skill(fqn) (GetSkill at /2.1/unity-catalog/skills/<fqn>, reusing _skill_ref; NOT_FOUND to None) and download_selected_skills(fqns, path) (one _download_refs pass over the flat selection). Both are dead code until PR D wires the picker.

Deviations from the design doc

• download_managed_skills_on_launch is a second caller of _fetch_bundles the doc did not mention; it is updated to the new keying (behavior-preserving).
• The doc lists should_download_skill / _reject_bundle_name_collisions as reused unchanged, but making the core location-agnostic means they read the source off the ref. The emitted messages are identical (<catalog>.<schema>.<securable> equals ref.fqn).

Testing

uv run ruff check ., ruff format --check src tests, and uv run pytest all pass (the 2 pre-existing e2e failures in test_e2e_user_agent and test_claude_smart_routing_v2 are unrelated and also fail on the base branch). New unit tests cover _download_refs (including cross-schema dedup), get_skill (NOT_FOUND to None, unfinalized to None), and download_selected_skills.

Stacked on #574 (skills-picker-walk).

This pull request and its description were written by Isaac.

[sunishsheth2009]

P1 (defense-in-depth): bundle_name flows straight into filesystem paths — write_skill does root / ref.bundle_name, and _skill_installs records those same dirs, which ug skill remove later shutil.rmtrees. Today that's safe because, as this docstring says, FinalizeSkill enforces Agent Skills naming rules server-side (no .//), so a legit bundle_name can't traverse. But it's a remote-provided value feeding a write and delete sink with zero client-side check — if the server guarantee ever regresses or is bypassed, we write/delete outside the skill dir. A one-line guard where the ref is built (reject .., /, or absolute paths, skip+warn) is cheap insurance for a delete sink. Not exploitable as-is — flagging for hardening.