Ignore inline YAML comments in skill frontmatter

[time-attack]

A skill whose frontmatter has a comment after a value, like name: demo # note, was read as the name demo # note. qm check rejected it, and the core seed parser threw the same name error. Reported by @javieraldape in #2081.

• Both frontmatter parsers (CLI cli/src/sandbox-layer.ts and core src/skills/frontmatter.ts) now strip an unquoted # comment once, before the >/| and [a, b] branches, so [a, b] # why, > # note and list items with a comment work too.
• # inside quotes and foo#bar (no space) are kept. A value that is only a comment is now empty, as in YAML, so it gives "missing name/description" instead of the literal # note.
• The scan is linear: a 200k-character line parses in about a millisecond, and a test guards it.

Tests: test/frontmatter.test.ts and cli/test/tool-descriptor.test.ts (drift-lock corpus) have new cases that fail on main; the CLI tool-descriptor/check suites (45) and the core frontmatter/normalize/ingest tests pass. Root and CLI typecheck, eslint and prettier are clean. Independently reviewed, including a fuzz against the yaml package (347k values, no regressions against main).

Before (main) / after on the issue's file:

main:  core seed-skill parser threw: skill name must be 1-128 ASCII letters, digits, ...
this:  parsed name = "demo"; qm check passes

Fixes #2081

[time-attack]

Before (main) / after (this PR), running qm check and the core seed parser on a skill with name: demo # human-readable note:

MP4, 1080p60

[time-attack]

In the web UI (Admin → Skills → Skill packs), importing a demo pack whose SKILL.md has name: release-notes # shown in the skill picker:

• Before (main), 1080p60: the description shows # keep it short, and Import selected fails with "internal server error" (core log: skill name must be 1-128 ASCII letters…), so neither skill is added.
• After (this PR), 1080p60: the description is clean and both skills import (pack shows 2 of 2).