Add bounded multi-source search skill

[denial123789]

What changed

Add multi-source-search, a portable research skill for bounded, cross-source fact checking. It includes:

• finite search and page-open budgets with explicit stop conditions;
• independent-origin confidence rules and circular-reporting protection;
• a machine-readable evidence-ledger schema;
• an offline Python validator for report structure and confidence consistency;
• read-only authority, privacy, and prompt-injection boundaries.

The skill is adapted from the Apache-2.0 SandBase Skills implementation for this marketplace. It intentionally uses host-agent capabilities rather than requiring SandBase services, so it remains portable across Goose and other Agent Skills hosts.

Why

Research agents often keep searching without a measurable completion condition or overstate confidence from multiple URLs that share one origin. This skill makes the loop finite and the resulting evidence internally checkable.

Validation

• node scripts/validate-skills.mjs --skills multi-source-search — passed
• security scan of the three new files — FAIL=0, one expected review warning for the schema’s example URL
• valid two-source fixture — accepted by validate_report.py
• intentionally overconfident one-source fixture — rejected as expected
• git diff --check

Known CI dependency

The base repository’s security scanner currently throws on a stray sks identifier after writing its report. A separate one-line fix is in #71 so this submission can be evaluated by the intended workflow without mixing unrelated changes here.