Add sync-skills-vendor.json for the vendored skills tree

Why

VS Code vendors Agent Skills under plugin/skills/ from jfrog/jfrog-skills, but unlike Claude, Cursor, Codex, Devin, Kiro, OpenCode, and JetBrains, this repo has no sync-skills-vendor.json.

Skills still land here: public Sync Plugins copies plugin/skills/ and patch-bumps marketplace.json + plugin/.claude-plugin/plugin.json. That is enough to ship (see #64 / skills v0.31.1). This issue is parity and ops, not a merge blocker for that PR.

What we do have is .github/scripts/sync-modules-vendor.json, which pins agent-hooks modules, not skills.

What to add

Match the other plugins:

1. Add .github/scripts/sync-skills-vendor.json, e.g.

{
  "repo": "jfrog/jfrog-skills",
  "pin": "v0.31.1",
  "paths": ["skills"]
}

(with dest_prefix / copy path so the tree lands at plugin/skills/, same as today's sync.)

2. Add a sync-skills.mjs (copy from claude/cursor) so a human can re-vendor from the pin.
3. Optionally a CI check that plugin/skills/ matches the pin (same idea as check-vendored-modules.mjs).
4. On github.com/jfrog/jfrog-skills, add pin_updates for vscode-plugin in .github/plugins.json so Sync Plugins writes the pin on each skills release.
5. Point VENDOR.md (Skills section) at the new pin file.

Not this issue

• Do not block #64 on this.
• Do not change sync-modules-vendor.json / agent-hooks (v0.11.1 is a separate pin).