web-design-guidelines: pin the rules instead of fetching them from `main` at runtime

The web-design-guidelines skill tells the agent to fetch its rules before every review from:

https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md

That file is mutable, and the fetched text becomes the agent's instructions. Anyone who can change it (a compromised account, a bad merge, a hijacked branch) can steer every agent using this skill, and nobody installing the skill gets to review the change first. It also adds a network dependency: if the fetch fails or is blocked, the skill has no rules to work from.

Suggestion: pin the URL to a commit SHA instead of main, or bundle a versioned snapshot of command.md in the skill folder and update it with each release. An optional SHA-256 checksum in SKILL.md would let agents and users confirm the file they loaded is the one you published.

For reference, we keep a pinned copy that bundles the rules at a fixed commit: https://github.com/globe-teck/agent-skills-pinned

Thanks for the skill, it's been useful in our UI reviews.