fix(#2857): prevent npm scoped package paths from being resolved as skill paths

resolveSkillPathReferences: add looksLikeFilePath() guard that requires
a file extension or trailing slash before resolving @scope/package
references. npm packages like @mycom/my_mcp_tools@beta were incorrectly
being rewritten to absolute paths in skill templates.

2 new tests.

src/shared/skill-path-resolver.ts

@@ -1,10 +1,17 @@
 import { join } from "path"
 
+function looksLikeFilePath(path: string): boolean {
+	if (path.endsWith("/")) return true
+	const lastSegment = path.split("/").pop() ?? ""
+	return /\.[a-zA-Z0-9]+$/.test(lastSegment)
+}
+
 /**
  * Resolves @path references in skill content to absolute paths.
  *
  * Matches @references that contain at least one slash (e.g., @scripts/search.py, @data/)
  * to avoid false positives with decorators (@param), JSDoc tags (@ts-ignore), etc.
+ * Also skips npm scoped packages (@scope/package) by requiring a file extension or trailing slash.
  *
  * Email addresses are excluded since they have alphanumeric characters before @.
  */
@@ -12,6 +19,9 @@ export function resolveSkillPathReferences(content: string, basePath: string): s
 	const normalizedBase = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath
 	return content.replace(
 		/(?<![a-zA-Z0-9])@([a-zA-Z0-9_-]+\/[a-zA-Z0-9_.\-\/]*)/g,
-		(_, relativePath: string) => join(normalizedBase, relativePath)
+		(match, relativePath: string) => {
+			if (!looksLikeFilePath(relativePath)) return match
+			return join(normalizedBase, relativePath)
+		}
 	)
 }