Lift the skills cache-path layout and safe-name check into shared/

Follow-up from the #181 review.

The Orbit main process re-derives the skills cache layout by hand in the `skills:refresh` handler (`app/src/main/ipc-handlers.ts`): it builds `~/.loom/cache/skills`, matches `@` dirs, and inlines the `/^[A-Za-z0-9._-]+$/` name check. The brain side already owns these -- `skillsCacheDir`/`createSkillsCacheTag` in `extensions/loom/skills-discovery.ts` and `isSafeSkillName` in `extensions/loom/skills.ts`.

Not a security hole: the refresh only `rm`s real dir entries under the base, so there's no traversal (confirmed in review). It's a drift risk -- if the on-disk layout ever changes (version segment, hash length, base dir), the refresh button silently stops clearing the right dirs, and the failure is swallowed.

Main can't import from `extensions/loom` (separate process), so the fix is a small `shared/skills-cache.(js|d.ts)` exporting the base dir, the `@` prefix rule, and the safe-name check, imported by both sides (`shared/loom-config` is the precedent).

Start in app/src/main/ipc-handlers.ts at the skills:refresh handler, then compare its cache layout and name check with skillsCacheDir/createSkillsCacheTag in extensions/loom/skills-discovery.ts and isSafeSkillName in extensions/loom/skills.ts. Use shared/loom-config as the precedent for shared/skills-cache.(js|d.ts). Done means both sides import the shared rules and refresh still clears the intended cache directories.

Written by the indexing model from the issue text.