feat(skills): support loading skills from GitHub/Git URLs

[dgallitelli]

Summary

Closes #2090

• Add support for remote Git repository URLs as skill sources in AgentSkills and Skill.from_url()
• Support https://, git@, and ssh:// URLs with optional @ref suffix for branch/tag pinning (e.g., https://github.com/org/skill@v1.0.0)
• Repositories are shallow-cloned (--depth 1) and cached locally at ~/.cache/strands/skills/ (configurable via cache_dir parameter)

Usage

from strands import Agent, AgentSkills

# Load skill directly from a GitHub repo
plugin = AgentSkills(skills=["https://github.com/dgallitelli/aws-data-agent-skill"])

# With version pinning
plugin = AgentSkills(skills=["https://github.com/org/skill-repo@v1.0.0"])

# Mixed with local skills
plugin = AgentSkills(skills=[
    "https://github.com/org/skill-repo",
    "./local-skills/my-skill",
])

# Or use the Skill classmethod directly
from strands import Skill
skills = Skill.from_url("https://github.com/org/skill-repo@main")

Changes

File	Change
_url_loader.py (new)	URL parsing, git clone with shallow depth, hash-based caching
skill.py	Added Skill.from_url() classmethod
agent_skills.py	Updated _resolve_skills() to detect URL strings; added cache_dir parameter
test_url_loader.py (new)	22 tests for URL detection, parsing, cache keys, and clone behavior
test_skill.py	6 tests for Skill.from_url()
test_agent_skills.py	4 tests for URL resolution in AgentSkills

Design decisions

• Git clone via subprocess: No new dependencies — uses git which is universally available. Handles auth naturally (SSH keys, credential helpers, tokens).
• Shallow clone: --depth 1 minimizes bandwidth and disk for skill repos.
• Hash-based caching: sha256(url + ref)[:16] as cache directory name. Repeated loads are instant.
• Graceful degradation: Failed URL clones log a warning and skip (consistent with how nonexistent filesystem paths are handled).
• No new dependencies: Only stdlib modules (subprocess, hashlib, shutil).

Test plan

• All 171 skill tests pass (32 new tests added)
• Ruff lint and format pass
• Pre-existing mypy error is unchanged (unrelated @hook decorator typing)
• Manual test with a real public skill repo (e.g., aws-data-agent-skill)
• Manual test with a nested real public skill repo (e.g., obra/superpowers/brainstorming)