Pin a short skill allowlist instead of shopping the registry

A SaaS team should pin a short agent-skills allowlist in the repo instead of shopping the public registry every sprint. Amelia Charles, Andrew Qu, and Jonathan Hefner published the report behind that