URL-Based Custom Marketplace Integration for Skills & Agents

### Feature summary

Enable organizations to connect private or custom marketplaces for Copilot Skills and Agents by providing a simple URL endpoint — without relying on the public GitHub Marketplace.

### What problem are you trying to solve?

Enterprise customers operate within strict compliance, security, and infrastructure constraints. Today, Skills and Agents discovery is tightly coupled to the public marketplace, which creates blockers for organizations that:

Host internal tools and proprietary agents on private infrastructure
Cannot expose or approve public marketplace content due to regulatory requirements
Need full control over which capabilities are available to their developers

### Proposed solution

Allow to register one or more custom marketplace endpoints via a URL. The platform would query these endpoints using a standardized API contract to discover and load available Skills and Agents.

Security controls should include:

Admin-managed allowlist of approved endpoint URLs
Org-level policy enforcement to restrict or mandate specific sources
Authentication support (e.g., tokens, mTLS) for private endpoints
No mixing of unapproved external sources with internal registries

### Workflow impact

_No response_

### Installation context

_No response_

### Additional context

This capability unlocks GitHub Copilot adoption for enterprises with air-gapped or regulated environments. It reduces friction for platform teams managing internal developer tooling, enables self-hosted extensibility, and positions GitHub Copilot as a compliant, enterprise-grade platform — directly competing with internal AI tooling alternatives that offer full deployment control.

The issue names no repository files, tests, or entry points. Start by mapping the proposed marketplace endpoint contract, organization policies, allowlist behavior, and authentication requirements. Done means the scope and acceptance criteria cover private endpoint discovery, approved-source enforcement, and enterprise deployment constraints.

Written by the indexing model from the issue text.