XDE-85: bump skillget-manager to v0.1.4 (vendor)

[remdev]

Summary

• go get github.com/getskillpack/skillget-manager@v0.1.4 + go mod vendor
• Indirect: golang.org/x/mod (semver in manager)
• CHANGELOG: dependency note + link to REGISTRY_CLIENT_CONTRACT.md

Follows merged getskillpack/skillget-manager#1 and tag v0.1.4.

Paperclip: XDE-85.

[Copilot]

Pull request overview

Bumps the vendored github.com/getskillpack/skillget-manager dependency to v0.1.4 (and vendors a new indirect dependency golang.org/x/mod/semver) to align the CLI with updated registry client/JSON contract behavior.

Changes:

• Update skillget-manager to v0.1.4 and refresh vendor/ accordingly (including golang.org/x/mod/semver).
• Adjust vendored manager behavior: “latest” resolution uses max semver from versions map; optional read bearer token is used for GET requests and archive downloads.
• Update changelogs to document the dependency bump and contract link.

Reviewed changes

Copilot reviewed 2 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
vendor/modules.txt	Reflects bumped vendored modules and adds golang.org/x/mod.
vendor/golang.org/x/mod/semver/semver.go	Adds vendored semver implementation used by the manager.
vendor/golang.org/x/mod/PATENTS	Adds vendored patents notice for golang.org/x/mod.
vendor/golang.org/x/mod/LICENSE	Adds vendored license for golang.org/x/mod.
vendor/github.com/getskillpack/skillget-manager/types.go	Updates registry JSON types (versions map, new metadata fields).
vendor/github.com/getskillpack/skillget-manager/resolve.go	Changes unpinned version selection to max semver among non-yanked versions.
vendor/github.com/getskillpack/skillget-manager/registry_errors.go	Updates auth-related hint text for read token support.
vendor/github.com/getskillpack/skillget-manager/download.go	Adds optional bearer auth to archive downloads.
vendor/github.com/getskillpack/skillget-manager/config.go	Introduces RegistryReadBearer() (read token with fallback).
vendor/github.com/getskillpack/skillget-manager/client.go	Adds optional bearer auth to GET JSON calls.
vendor/github.com/getskillpack/skillget-manager/README.md	Documents new behavior/token and semver “latest” selection.
vendor/github.com/getskillpack/skillget-manager/CHANGELOG.md	Adds upstream v0.1.4 changelog entry.
go.sum	Updates sums for skillget-manager and adds golang.org/x/mod.
go.mod	Bumps skillget-manager, adds indirect golang.org/x/mod, and adds a toolchain directive.
CHANGELOG.md	Notes the dependency bump and links the client contract doc.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This PR introduces a toolchain go1.22.12 directive. That change isn’t mentioned in the PR description and can change build behavior by forcing Go to auto-download/pin a specific patch toolchain (potentially impacting offline/hermetic builds and CI caching). If the intent is just to bump skillget-manager, consider removing the toolchain line; if pinning is desired, update CI/tooling docs to use the same exact Go patch (e.g., setup-go go-version: 1.22.12) so builds don’t unexpectedly download a different toolchain.