fix(shared): avoid false-positive skill path resolution on npm scoped packages (#2857)

The @scope/path regex incorrectly matched npm scoped package references
like 'require(\"@scope/pkg\")' or '--package=@scope/pkg'. Added context
filtering to exclude matches preceded by npm/import indicators.

🤖 Generated with OhMyOpenCode assistance
https://github.com/code-yeongyu/oh-my-opencode

src/shared/skill-path-resolver.test.ts

@@ -149,4 +149,16 @@ describe("resolveSkillPathReferences", () => {
 		//#then
 		expect(result).toBe("Inspect @data/../../../secret/")
 	})
+
+	it("does not resolve npx --package=@scope/pkg as skill path", () => {
+		//#given
+		const content = "npx --package=@scope/pkg"
+		const basePath = "/skills/frontend"
+
+		//#when
+		const result = resolveSkillPathReferences(content, basePath)
+
+		//#then
+		expect(result).toBe("npx --package=@scope/pkg")
+	})
 })

src/shared/skill-path-resolver.ts

@@ -9,7 +9,7 @@ function looksLikeFilePath(path: string): boolean {
 export function resolveSkillPathReferences(content: string, basePath: string): string {
 	const normalizedBase = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath
 	return content.replace(
-		/(?<![a-zA-Z0-9])@([a-zA-Z0-9_-]+\/[a-zA-Z0-9_.\-\/]*)/g,
+		/(?<![a-zA-Z0-9="\(])@([a-zA-Z0-9_-]+\/[a-zA-Z0-9_.\-\/]*)/g,
 		(match, relativePath: string) => {
 			if (!looksLikeFilePath(relativePath)) return match
 			const resolvedPath = resolve(normalizedBase, relativePath)