fix(catalog): guard form submission re-entry

Description

The pitch.

## Summary

Rescues the client-side re-entry guard from @stanleyoz's legacy #204 onto current main. The retained SkillMD form could queue a second action when submit events arrived before the pending render or while the first action was outstanding.

- Add a synchronous, per-mounted-form submit guard; release it when the action is no longer pending.
- Keep React's existing Server Action wiring and pending button.
- Add six DOM tests using the real form and React action queue, replacing only the server action boundary.
- Document the distinction between this UI guard and server-side idempotency.

## Scope and provenance

Partial replacement for #204, not adoption of its 15-second read-before-insert lookup. That lookup can race across requests and can conflate separate submissions with matching name/source. Separate tabs, HTTP retries and concurrent server writes still need a designed operation-key and atomic-persistence contract. No database migration or cleanup of existing duplicates is included. No live catalog was accessed.

The original source PR will be closed with this replacement link only after this change lands; this does not mark the original branch as merged.

## Verification

- Baseline: 36 dashboard tests passed.
- Initial regression: two tests failed because two submit events produced two server-action calls; the immediate validation-retry control passed.
- Final: 42 dashboard tests passed, including six form lifecycle cases covering queued/in-flight repeats, immediate validation failure, native validation and immediate/delayed success.
- Removing guard release produced four expected retry failures; restored final tests passed.
- TypeScript and new test-file ESLint passed.
- Production Next webpack build passed.
- Full Town Python suite: 385 passed, eight existing warnings.
- The form's pre-existing reset-effect ESLint error is unchanged and reproduced on the base revision. No claim of a clean full-dashboard lint run.
- Pinned jsdom 26.1.0 is dev-only; all 34 added lockfile packages are dev dependencies, with no previous package version changes or removals.

Local self-review only. DOM tests do not claim browser hydration, live database concurrency or deployed Next end-to-end coverage.