Portable provenance, integrity, and drift control for agent skills across sessions, surfaces, and platforms