chore: retire generated public distributions

[byapparov]

Closes aictrl-dev/aictrl#3921

Summary

• remove the generated Claude, Codex, and OpenCode public skill packages from the legacy repository
• remove the public assembly lock, duplicated submission packet, and vendor lifecycle jobs now owned by aictrl-dev/skills
• keep the existing @aictrl/plugin tenant installer and authenticated production MCP catalog smoke supported
• point public users to the canonical one-root distribution and add a regression test that rejects recreated generated paths
• retry transient skill fetch failures serially and fail before replacing an existing installation when a refresh remains incomplete
• restrict this repository's release resolver to the legacy root npm package

Cutover gate

This PR is intentionally a draft. Do not merge it until:

• aictrl-dev/skills#9 is merged and released
• @aictrl/opencode is publicly installable with verified registry integrity
• clean Claude, Codex, and OpenCode installs succeed from the unified release
• rollback evidence confirms the legacy generated packages are no longer needed

The existing npx @aictrl/plugin organization/API-key installer remains available after this cleanup.

Test plan

• npm ci
• npm run build
• npm test — 147 tests
• git diff --check
• actionlint .github/workflows/*.yml
• root release resolver accepts v2.2.1 and rejects public-v0.1.0
• npm pack . --dry-run --json --ignore-scripts contains only the legacy root package surface

[byapparov]

Cutover evidence verified after beta.2 publication:

• @aictrl/opencode@1.1.0-beta.2 is public from release commit 696bf2eedfbf9d6e51d6890c4dabadc994e98501.
• Fresh Claude, Codex, and OpenCode installs passed against the tagged release; each installs eleven skills and uses https://aictrl.dev/mcp.
• Rollback rehearsal passed with @aictrl/opencode@1.1.0-beta.1 (install and clean removal).
• Stable @aictrl/plugin@2.2.1 remains published for existing tenant-managed installations.

The PR is now ready for review; all CI, CodeQL, production MCP smoke, and legacy installer E2E checks are green.