A business analyst on a logistics team uses Copilot to draft carrier updates. The team approved a vendor-provided skill pack for shipment tracking, needs it available in Copilot, and must keep provenance and version control. Which installation approach best satisfies external skill governance?

The correct approach satisfies all three governance constraints because sourcing from the vendor-owned versioned repository preserves provenance and auditability, Copilot availability makes the approved capability usable in the analyst workflow, and pinning updates to reviewed releases enforces version control and prevents untested changes from entering logistics communications. The centralized deployment with automatic approval of minor updates preserves vendor sourcing and availability and follows a common evergreen practice, yet it fails strict version control because even minor commits bypass explicit review and can alter tracking behavior without approval. The personal installation from the versioned source with manual tracking of reviewed releases preserves provenance and change discipline and is common for piloting, yet it fails enterprise availability because the skill remains scoped to one user rather than published for the logistics team in Copilot. The deployment from a versioned internal mirror pinned to reviewed releases preserves availability and change discipline and is common for resilience, yet it fails provenance because detaching upstream linkage removes verifiable vendor origin and signed history. As an exam caveat, familiar enterprise patterns remain incorrect when one governance keyword is violated, so match every constraint rather than choosing by efficiency. Practically, verify the skill shows the vendor repository URL, team scope, and pinned reviewed tag before carrier-update use.