fix(web-design-guidelines): pin upstream rules to reviewed commit

Summary

• Pin the web-design-guidelines skill's remote command.md source to reviewed commit 4e799d45c17aec1498c269287a83b9dba22b966b.
• Document that future upstream guideline updates should land through a reviewed SHA change.
• Keep the existing review workflow and output contract unchanged.

This addresses #316 by removing the mutable main branch from the skill's instructions and making repeated runs of the same skill revision reproducible.

Verification

• git diff --check origin/main...HEAD
• Static pin check confirms the URL contains a 40-character commit SHA.
• Fetched the pinned URL and verified HTTP 200.
• Confirmed the pinned SHA matches the current web-interface-guidelines main tip via the public GitHub API.

Collision / policy check

• No open pull request currently changes skills/web-design-guidelines/SKILL.md or pins this source; #315's unrelated guideline references are in React/composition skills.
• Repository AGENTS.md requires small, focused skill changes; no root CONTRIBUTING or SECURITY policy files are present in the public default branch.