Filter non-skill dirs from Claude Code sync

[DROOdotFOO]

Problem

The agent-skills external mirrors upstream skills/ verbatim. Upstream now
keeps non-skill dirs there alongside real skills:

• cancer-predisposition-variant-analyst/ -- a git submodule; tarball archives
  carry it as an empty placeholder (no SKILL.md, and never will via tarball).
• alternatives/, hooks/, pg-essays/, scribe/, shared/, suites/,
  workflows/ -- support packages, hook scripts, CI config. No SKILL.md.

run_after_sync-skills.sh symlinked every top-level dir into ~/.claude/skills/,
so these surface in Claude Code as description-less junk skill entries. Raxol is
unaffected (it scans **/SKILL.md).

Fix

Filter at the sync layer instead of enumerating excludes. An include-glob can't
distinguish a skill from a support dir -- both live at skills/<name>/; the only
difference is a sibling SKILL.md, which no glob can test. So the guard belongs
where the Claude Code skill set is actually selected.

• run_after_sync-skills.sh.tmpl: add is_skill_dir() (SKILL.md present);
  route both the create loop and the stale-link pruner through it. Skips
  non-skill dirs (current and future) and prunes links whose target lost its
  SKILL.md.
• .chezmoiexternal.toml: keep it a faithful upstream mirror; note the filter.

Manual testing

• shellcheck -x run_after_sync-skills.sh.tmpl -- clean
• Ran the sync script: 59 real skills -> 59 symlinks; cancer + all 7 support
  dirs excluded; 0 broken links; 0 real skills dropped (60->59 delta is the
  expected virtuals-protocol-acp name-clash across both roots)
• Forced chezmoi apply --refresh-externals -- non-skill dirs stay unlinked