fix(validation): accept any-case SKILL.md filename on upload

[XiaoSeS]

Closes #458.

Summary

• Upload of a skill package with skill.md (lowercase, or any other case variant) previously failed with Missing required file: SKILL.md at root. This was a frequent papercut on macOS / Windows because their case-insensitive filesystems happily let authors save the file with non-canonical casing.
• Root cause: five call sites compare entry paths against the constant SKILL_MD_PATH = "SKILL.md" using case-sensitive .equals(...).
• Fix: fold the basename to the canonical SKILL.md inside SkillPackagePolicy.normalizeEntryPath(...) — the single normalization point both SkillPackageValidator and SkillPackageArchiveExtractor already route every path through. Every downstream comparison then succeeds without further changes.

The OpenSkills protocol declares uppercase SKILL.md as the canonical filename, so accepting any case but storing the canonical form is the right semantic — not a workaround.

Test plan

• SkillPackageArchiveExtractorTest — 3 new regression tests: lowercase skill.md at root, mixed-case Skill.MD inside a single root directory, lowercase skill.md requiring directory promotion. 18/18 pass.
• SkillPackageValidatorTest — 1 new test covering the validator-only path (e.g., CLI dry-run that doesn't go through the extractor). 17/17 pass.
• Full sweep on SkillPublishControllerTest, CliDryRunValidateTest, BasicPrePublishValidatorTest, SkillPublishServiceTest — no regressions. 27 tests, 0 failures.

[gemini-code-assist]

Code Review

This pull request introduces automatic canonicalization of the SKILL.md filename to ensure case-insensitive matching. It includes logic in SkillPackagePolicy to fold case variants (like skill.md or Skill.MD) to the uppercase SKILL.md and adds comprehensive unit tests in SkillPackageArchiveExtractorTest and SkillPackageValidatorTest to verify this behavior across different directory structures and validation scenarios. I have no feedback to provide.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

PR Review Helper seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}