feat: define skill placement and provenance policy (#748)

scripts/ci/validate-install-manifests.js

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
 /**
  * Validate selective-install manifests and profile/module relationships.
+ * Module paths are curated repo paths only. Generated/imported skill roots
+ * (~/.claude/skills/learned, etc.) are never in manifests.
  */
 
 const fs = require('fs');
@@ -109,6 +111,7 @@ function validateInstallManifests() {
       const normalizedPath = normalizeRelativePath(relativePath);
       const absolutePath = path.join(REPO_ROOT, normalizedPath);
 
+      // All module paths must exist; no optional/generated paths in manifests
       if (!fs.existsSync(absolutePath)) {
         console.error(
           `ERROR: Module ${module.id} references missing path: ${normalizedPath}`