feat: `cmd skills update` -- record install source so skills can be updated

Problem

cmd skills add does not record where a skill came from. Once installed, there is no manifest mapping skill name to source repo -- nothing in ~/.commandcode/ or the skill directory preserves the owner/repo[/path][@ref] spec used at install time.

Consequence: there is no way to update an installed skill from within the CLI. cmd skills only has add / remove / list (unchanged since v0.18.2). The only update path is:

1. Rediscover the source repo yourself (out of band -- the CLI can't tell you)
2. Re-run cmd skills add <owner/repo/path> -f

For skills installed from multi-skill repos or subpaths (e.g. cmd skills add acme/repo/path/to/skill), rediscovering the exact spec is genuinely error-prone.

Prior art

• Mods already solve this in Command Code itself: cmd mods update reinstalls and reconciles every configured mod package, because mod sources are tracked in settings.json. Skills are the odd one out.
• GitHub CLI shipped gh skill (v2.90.0, April 2026), which records provenance metadata at install time and supports gh skill update [name|--all] across agent hosts.

Proposal

1. At cmd skills add time, write the resolved source spec (owner/repo[/path][@ref] plus installed commit SHA) to a manifest -- either a skills.json alongside the skills directory or a per-skill metadata file.
2. Add cmd skills update [skill-name] and cmd skills update --all: re-fetch from the recorded source and overwrite in place (same semantics as add -f).
3. cmd skills list could then also show source + whether upstream has moved.

Part 1 is the load-bearing piece -- without provenance, no update verb is possible. Backfill for already-installed skills can be manual (prompt on first update, or accept a spec argument to re-pin).

Tested on v1.5.0 (macOS); docs at commandcode.ai/docs/skills confirm only add/list/remove exist.

Start with the existing cmd skills add, list, and remove entry points, then compare the provenance handling in settings.json used by cmd mods update. Done means installs preserve the source spec and commit SHA, while cmd skills update [skill-name] and --all can re-fetch and overwrite installed skills; check the skills documentation for the current command surface.