Update from source

Port upstream changes into adapted skills, keeping local adaptations. Scope is the repos or skills named in the request; with none named, every drifted skill.

1. Find drift

git submodule update --remote source-skills/<owner>-<repo>
python3 scripts/check-provenance.py --fail-on-drift

Each failure names a skill whose based_on_version commit differs from the new submodule pin. The recorded commit is the base, the new pin is the target. Drift on a skill's source files is the only change that matters; skip skills whose upstream files are untouched between base and target.

Marketing sub-skills record their source in skills/marketing/sub-skills/name-table.md rather than frontmatter. Treat each row's source path as that sub-skill's upstream.

2. Diff per skill

For each drifted skill, diff its upstream path between base and target: