Semantic package-closure validator for activate-skill-by-name command dependencies

## Context

PR #2602 fixed a packaging gap: the standalone `hve-core` package exposed two Azure DevOps commands while omitting the `backlog-management` skill both of them mandate. Each prompt instructs the reader to activate that skill by name and to stop before any Azure DevOps call when it does not resolve, so a standalone install advertised commands that failed deterministically.

Marketplace validation did not catch this, because it validates that declared components exist — not that a command's runtime dependencies are satisfied by its own package.

Resolving the closure for that one fix required tracing both command paths by hand: reading each prompt for named skill activations, then reading the references those prompts reach for further activations. That is exactly the work a validator should do.

## Why this was deferred

Adding a validator is new capability rather than a correction. The immediate gap was closed by adding the missing skill to the recipe.

## Proposed work

A semantic package-closure validator that resolves activate-skill-by-name dependencies per package.

## Acceptance criteria

- [ ] For every package, every command it exposes has its named skill dependencies present in that same package
- [ ] Transitive activations are followed: a skill reference that activates another skill by name counts as a dependency of the command that reaches it
- [ ] A missing dependency fails validation and names the package, the command, and the unresolved skill
- [ ] The check runs as part of marketplace validation
- [ ] The `hve-core` and `project-planning` packages pass without modification, confirming the check agrees with the hand-traced result

## Notes

The dependency signal is prose, not structured metadata: prompts say "activate the `` skill by name". A validator either parses that convention or the repository introduces structured declarations. Worth deciding which before implementing.

## Evidence

- PR #2602 review threads covering the packaging gap
- `.github/plugin/marketplace.json` — package recipes
- `.github/prompts/hve-core/ado-create-pull-request.prompt.md` and `ado-get-build-info.prompt.md` — the activate-by-name pattern
- `scripts/plugins/Validate-Marketplace.ps1` — current validation scope