Import Catalog Skills

Copy catalog skills into the caller's library and attach them.

An import is a copy, not a link: the bundle is written to the caller's own prefix, so the result is an ordinary skill that can be edited, renamed and deleted. source_ref records which upstream revision it came from.

Ordered in three phases, and the boundaries between them are the point:

1. Resolve and validate, touching neither S3 nor a transaction. A rejected selection therefore leaves nothing behind at all.
2. Upload every bundle, still outside any transaction. Uploads used to run inside it, which meant every workspace lock and every inserted row was held across up to 50 sequential S3 round trips — the transaction was open for as long as the slowest storage call took.
3. Insert and attach, in one short transaction.

Rows are inserted in ascending name order so two concurrent imports by the same user take the unique index's locks in the same sequence. Interleaved orders deadlock, and a deadlock surfaces as OperationalError rather than IntegrityError — so it would have escaped the 409 handler that exists for exactly that collision and become a 500.