feat: add crate package sync with isolated storage namespace

[oritwoen]

Description

This PR adds Rust crate support to skilld with crate:<name> (e.g. skilld add crate:serde), while preserving existing npm/git behavior.

What’s included:

• crates.io resolver implementation (src/sources/crates.ts)
• crate-aware sync routing (src/commands/sync.ts)
• mixed-batch support without degrading npm parallel sync
• npm/crate collision prevention via crate storage namespace (@skilld-crate/<name>) and crate identity (crate:<name>) in lock metadata
• shared fetch/rate-limit helper improvements in src/sources/utils.ts
• README updates for new usage examples

Tests:

• test/unit/sources-crates.test.ts
• test/unit/sync-crate-routing.test.ts
• test/unit/sync-crate-version.test.ts
• test/e2e/crate-smoke.test.ts

Validation:

• unit tests for crate paths pass
• crate e2e smoke test passes
• pnpm typecheck passes
• pnpm build passes

Linked Issues

N/A

Additional context

Please focus review on namespace separation and cache/identity consistency in src/commands/sync.ts.

[harlan-zw]

This is a really cool direction. I'll need to get back to you on it in the next couple of days.

[oritwoen]

Sure, I tried to make it as agnostic as possible to open up support for other packages like Go, Python, etc. in next pull requests, but I feel like I'm missing something. Anyway, thanks for taking a look when you have a moment :)

[harlan-zw]

So, thinking a bit on this, I think it definitely has its place, but there are a few items on the roadmap I want to sort before we ship cross-language support.

• v1.0 - Official release (~ next monday)
• v1.1 - Maintainer mode (allow maintainers to self-publish their own skills as part of releases) (~next week sometime)
• v1.2 - ?
• v2 - Rust / Python / etc support

My current concern is that going too broad before there's enough feedback will make quicker iterations more difficult. But I'm keen to ship this stuff as quickly as possible as the package needs to gain as much momentum as it can while still nailing the DX so I don't think we need to wait too long to merge (2-3 weeks).

[oritwoen]

I was also thinking about this after submitting this pull request and will change it to a draft for now.

I was wondering what exactly was missing from an agnostic perspective. I've been using Rust and Python, and various languages ​​for agents depending on my needs, which is where this PR came from. However, after its creation, I realized there was a gap in the node ecosystem itself. There was no package that aggregated information from various registries from different languages ​​into a single form, cached it, and made it usable offline.

I'm currently working on:

Universal package registry client. Query npm, PyPI, crates.io, RubyGems, Packagist, and more with a single PURL-native API.

And once that's released, I'll modify this PR to support my package, which will then support all registries simultaneously.

And thanks so much for skilld!

[harlan-zw]

That sounds really useful, I would be very happy to receive that PR :)