insider: move the variants dataset into its own subfolder (complete the multi-dataset layout)

INSIDER became a two-dataset provider when `insider:interfaces` was added in #231, but its
layout only half-follows the plugin convention.

`hvantk/skills/_conventions/SKILL.md` and `CLAUDE.md` both say:

> Multi-dataset providers add one subfolder per dataset plus a `shared/` folder.

Current layout:

```
hvantk/skills/insider/
├── builder.py <- variants, still at the provider root
├── drift_probe.py
├── plugin.yaml
├── shared/ <- added in #231 (7712b503)
├── interfaces/ <- interfaces, correctly in its own subfolder
└── tests/ <- variants tests, still at the provider root
```

For comparison, `hvantk/skills/cptac/` is the reference and splits cleanly into
`expression/`, `phospho/` and `shared/`.

## What is already done

#231 added `insider/shared/` and moved the `file://` path normalisation into it, so the
duplication between the two builders is gone — that was the concrete harm the convention
protects against.

## What is left

Move the `variants` dataset into `insider/variants/`: `builder.py`, its `tests/`, and the
`builder.module` / `drift_probe.module` paths in `plugin.yaml`.

## Why it was not done in #231

It re-points a working dataset's module paths in the manifest and its tests, mid-review, on
a branch that was already large. That is risk without correctness gain — the dedup fixed
the real problem, and the remaining change is purely structural.

## Notes for whoever picks it up

- `plugin.yaml` resolves builders by dotted module path, so the manifest must change in the
same commit as the move or the plugin fails to load.
- `hvantk/tests/test_plugin_smoke.py` asserts the exact set of registered datasets; it does
not need changing for a move, but it is the test that catches a broken manifest fastest.
- The snapshot fixtures for `variants` live under the plugin's `tests/` and are referenced
from `plugin.yaml`'s `tests:` block by relative path — those paths move too.