Verify declared component paths exist and enter resource validation #425

🤖 Generated by the Agentic Engineer

Problem

The real gate accepts skills: ["./absent/"]. It counts the default skills directory despite the unresolved declared path, allowing a consumer-facing component declaration to pass without its referenced files being examined.

Observed on fresh main during hands-on validation on 2026-10-03. The package cases exercise the production gate against a complete isolated fixture; the catalogue cases exercise its shared parser and native CLI argument contract.

Intended outcome

Require declared skill directories and agent files to exist within the marketplace's canonical skills/ and agents/ layout, validate their contents, and keep catalogue and provenance checks aligned with those selections. Reject alternate layouts explicitly until their discovery and validation are extended together. Cover missing and wrong-kind targets alongside healthy explicit paths.

Success proxy: a regression fails against current main, then passes with the root-cause repair; healthy packages and normal installation remain usable. No external adoption is claimed.

Size: S. Part of #38.