Well-known archive installs drop the executable bit

Installing from a well-known index (type: "archive", zip or tar.gz) writes every file as 0644. An executable script in the archive loses its +x, so a skill that runs ./scripts/run.sh fails with "permission denied" after install. Git sources keep the mode.

Repro (skills 1.7.6, Linux):

1. Make an archive with SKILL.md and scripts/run.sh (mode 0755), served from /.well-known/agent-skills/index.json.
2. npx skills add <url> -g -y
3. ls -l ~/.agents/skills/<name>/scripts/run.sh gives -rw-r--r--.

Cause: the zip reader reads each entry's external attributes, but only to reject links. The extracted files map keeps bytes only, so the mode never reaches the write. The tar.gz path ignores the header mode the same way.

Suggested fix: keep the executable bit from the zip external attributes (>>> 16) and the tar header mode, and apply it on write. Only 0755 vs 0644 is needed, never setuid or other bits.