Add npm + PyPI download stats as an adoption signal

[RichardBray]

Official public endpoints - the npm registry downloads API and pypistats.org - publish package download counts keylessly. When a topic resolves to a package (or a GitHub repo already found names one), download trends answer 'is this actually being adopted', which stars alone don't.

Best implemented as an enrichment of GitHub results rather than a standalone search: for top repos, look up the matching package and attach weekly downloads to that context entry.

Constraint check: official public APIs, keyless. ✅

[RichardBray]

Note: the PR implementing this must also update the README - the source list at the top and the "Design principles" section both enumerate the current sources (Firecrawl, Hacker News, GitHub), and SKILL.md's "How it works" list does too.