Give a package skill's slug the shape the skills API accepts

[Chebaleomkar]

What this changes

The comment above parseTenantSkills says "the shape the API enforces is enforced here too", but the patterns differ:

Where	Pattern
tenant-package.ts:616	/^[a-z0-9][a-z0-9-]*$/
plugins/routes.ts:2143 (skills API)	/^[a-z0-9][a-z0-9-]{0,38}[a-z0-9]$/
plugins/store.ts:2726	the same as the API
app/src/lib/skills/form.ts:20	the same as the API

So a package could seed a, a- or a sixty-character slug, and none of the other three would then accept or edit it. The package now uses the same pattern. The message keeps its existing prefix (skill.slug "…" must be lowercase …, which tenant-package.test.ts checks) and adds the length and the end rule.

Every slug in examples/fintech/skills.yaml already matches: find-a-document, find-a-notion-page, whats-changed, who-owns-this, check-a-claim, skill-creator, bot-creator.

Where it runs

• Validation only. No state, replica, serialisation, fan-out, listener or schedule change.

Boundary and audit

• Not touched.

Changelog

• A line under Unreleased, because a custom package with such a slug is now refused at load.

Proof

• tenant-package-agent-files.test.ts has a new table, and the file passes 15 of 15:
  • find-a-document, a1 and 40 characters are accepted;
  • a, a-, -a and 41 characters are refused.
• The existing slug cases in tenant-package.test.ts pass 2 of 2 against Postgres.
• tsc --noEmit on server/ exits 0, and biome is clean.

[davidmckayv]

The current head 86026bb matches the accepted source disposition from the refreshed triage. Required CI must pass before landing.