[iiwish]

Summary

• allow Team Library users to paste remote http(s) catalog URLs for Core read-only inspect / status / install plan
• block Desktop install apply for remote catalog URLs while keeping local catalog apply unchanged
• update Team Library docs, UI copy, tests, and hero smoke coverage for the URL read-only state

Validation

• npm test -- --run
• npm run build
• cd src-tauri && cargo check
• node --check scripts/hero-desktop-smoke.mjs
• git diff --check
• SKILLRUN_CLI=/Users/iiwish/self/skillrun/target/debug/skillrun npm run smoke:hero-desktop
• Browser UI check on http://127.0.0.1:1420/ at desktop and mobile viewports: URL field, remote read-only strip, no horizontal overflow, no console errors

Notes

• Desktop still depends on Core for all catalog JSON behavior.
• Remote URLs are not applied or downloaded by Desktop; install apply remains local catalog path only.