Users packaging skills on case-insensitive filesystems frequently submit
`skill.md` (lowercase). All five `equals("SKILL.md")` call sites then fail
with "Missing required file: SKILL.md at root".
Fold the basename to the canonical `SKILL.md` inside
`SkillPackagePolicy.normalizeEntryPath` — the single point both the
validator and the archive extractor route every path through — so every
downstream comparison succeeds without further changes.