`hermes skills search <q>`, the TUI gateway search and the dashboard
`/api/skills/hub/search` all returned zero results for a skill that is live
on skills.sh but not yet in the cached centralized index: with an available
index `_select_active_sources` drops every external registry, and nothing
re-asked them when the index came back empty.
`parallel_search_sources` — the one chokepoint every surface calls — now
re-queries the registries the index displaced (skills.sh, ClawHub, LobeHub,
well-known) when a non-empty query got no index match, inside the same
`overall_timeout` (a shared deadline, so the 30 s budget never doubles).
GitHub stays out of the fallback: a single miss (typo) would otherwise spend
an unauthenticated user's whole hourly GitHub budget. Browse (empty query),
index hits and explicit `--source` filters are unchanged.
The fan-out loop moved into `_fan_out` so both passes share the pool/timeout
handling instead of duplicating it.
Slimmer redo of #112509 (@KoNit-K), which put the fallback at the same
chokepoint but only for skills.sh and with a second copy of the pool code.
Fallback shape follows the reporter's Option A.
Fixes#112503
Co-authored-by: KoNit-K <124019182+KoNit-K@users.noreply.github.com>
13dcfc112b