Use @microsoft/vally library directly instead of vally-cli subprocess

Replace the npx-spawned vally-cli process with a direct call to the
@microsoft/vally core library in the external plugin quality gates scripts:

- Add @microsoft/vally as a devDependency in package.json
- Import runLint and LintConsoleReporter from @microsoft/vally
- Replace runVallyLintGate() process spawn with async API call:
  - runLint({ rootPath }) returns structured LintResults
  - LintConsoleReporter with a Writable capture stream collects
    text output without printing to stdout
- Make runExternalPluginQualityGates() async (propagated to
  runExternalPluginPrQualityGates() and both main entry points)
- Use Promise.all in runExternalPluginPrQualityGates() for parallel
  plugin checks
- Fix remaining skill_validator_status reference in pr-quality-gates
  summary string (now vally-lint=...) and YAML workflow table header
- Add 'npm install @microsoft/vally' step to both calling workflows

This removes a layer of indirection (Node -> npx -> CLI -> library)
and replaces it with a direct in-process library call, which is faster,
more reliable, and gives structured access to lint results.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

eng/external-plugin-pr-quality-gates.mjs

@@ -66,27 +66,27 @@ function aggregateResultStatus(pluginResults) {
   };
 }
 
-export function runExternalPluginPrQualityGates(plugins) {
+export async function runExternalPluginPrQualityGates(plugins) {
   if (!Array.isArray(plugins)) {
     throw new Error("plugins must be an array");
   }
 
-  const checkedPlugins = plugins.map((plugin) => {
-    const quality = runExternalPluginQualityGates(plugin);
+  const checkedPlugins = await Promise.all(plugins.map(async (plugin) => {
+    const quality = await runExternalPluginQualityGates(plugin);
     return {
       name: plugin?.name ?? "unknown",
       source: plugin?.source ?? {},
       source_tree_url: buildSourceTreeUrl(plugin),
       quality,
     };
-  });
+  }));
 
   const aggregate = aggregateResultStatus(checkedPlugins);
   const summary = checkedPlugins.length === 0
     ? "No changed external plugin entries were detected in plugins/external.json."
     : checkedPlugins
       .map((entry) =>
-        `- ${entry.name}: skill-validator=${entry.quality.skill_validator_status}, install-smoke=${entry.quality.smoke_status}, overall=${entry.quality.overall_status}`
+        `- ${entry.name}: vally-lint=${entry.quality.vally_lint_status}, install-smoke=${entry.quality.smoke_status}, overall=${entry.quality.overall_status}`
       )
       .join("\n");
 
@@ -120,6 +120,6 @@ if (import.meta.url === `file://${process.argv[1]}`) {
   }
 
   const plugins = JSON.parse(args["plugins-json"]);
-  const result = runExternalPluginPrQualityGates(plugins);
+  const result = await runExternalPluginPrQualityGates(plugins);
   process.stdout.write(`${JSON.stringify(result)}\n`);
 }