feat(examples): end-to-end proof of third-party framework-* discovery (#190)

[suleimansh]

Follow-up to #205 (the extension SPI). Discovery was only proven against a fake loader; this adds a real end-to-end proof and closes a gap it surfaced.

What's here

• examples/framework-hello - a plain third-party capability package (no build, default-exports a FrameworkExtension with a persona + a skill). The framework core never mentions it.
• examples/framework-discovery-demo - a project that depends on framework-hello. Its runDemo runs both halves of the seam for real: resolve + import the installed framework-* package from disk, then compose it into the agent frame, offline via the fake driver. pnpm start narrates it; pnpm test asserts it end-to-end.

Demo output:

discovered 1 framework-* extension(s): framework-hello
Detected Vike (confidence 0); framing with 4 persona(s), framework-hello, 1 skill(s)
greeter persona:   composed into the frame
hello-guide skill: composed into the frame
production-grade:  true

Gap this surfaced (fixed here)

An active extension's own skills were collected but never framed - run.ts only used the built-in SkillRegistry. Added composeSkills (symmetric with composePersonas): unions the registry-matched skills with every active extension's skills, deduped by name. run.ts now threads both an extension's personas and its doc pointers into the frame. Also exported discoverExtensions / readProjectSignals from @gemstack/framework for programmatic embedders.

Tests: new E2E test in the demo (real import + compose), plus unit tests for composeSkills and extension-skill framing. Repo typecheck (21) + build (9) green; framework 65/65, ai-autopilot 277/277 (one pre-existing flaky timing test, green on rerun). Changeset added (minor, both packages).