fix: register skill with explicit source field

[junyuyuan]

What & why

apply() registers the runtime skill without a source field:

ctx.skills.register({ name, description, content })

DSH's validateRuntimeSkill does not require source for runtime registrations (unlike provider candidates), so the catalog summary ends up with source: undefined. Any consumer assuming source is a string then crashes — e.g. dsh-memory-evolve's skill manager (/skills-manager/api/skills) does isProtectedSource(skill.source) → undefined.startsWith('project') → TypeError → the entire skills listing API returns 500, and the web Skill Manager shows "0 skills" (the user's own skills included).

Change

ctx.skills.register({name: meta.name,description: meta.description,source: 'bundled',content: fm[2].trim(),})

'bundled' matches the source value DSH already uses for skills shipped with a bundle.

Verified

GET /skills-manager/api/skills returns 200 with the full catalog after this change; skills list renders normally. Closes#1.