feat: `cmd skills update` -- record install source so skills can be updated

Problem

cmd skills add does not record where a skill came from. Once installed, there is no manifest mapping skill name to source repo -- nothing in ~/.commandcode/ or the skill directory preserves the owner/repo[/path][@ref] spec used at install time.

Consequence: there is no way to update an installed skill from within the CLI. cmd skills only has add / remove / list (unchanged since v0.18.2). The only update path is:

1. Rediscover the source repo yourself (out of band -- the CLI can't tell you)
2. Re-run cmd skills add <owner/repo/path> -f

For skills installed from multi-skill repos or subpaths (e.g. cmd skills add acme/repo/path/to/skill), rediscovering the exact spec is genuinely error-prone.

Prior art

• Mods already solve this in Command Code itself: cmd mods update reinstalls and reconciles every configured mod package, because mod sources are tracked in settings.json. Skills are the odd one out.
• GitHub CLI shipped gh skill (v2.90.0, April 2026), which records provenance metadata at install time and supports gh skill update [name|--all] across agent hosts.

Proposal

1. At cmd skills add time, write the resolved source spec (owner/repo[/path][@ref] plus installed commit SHA) to a manifest -- either a skills.json alongside the skills directory or a per-skill metadata file.
2. Add cmd skills update [skill-name] and cmd skills update --all: re-fetch from the recorded source and overwrite in place (same semantics as add -f).
3. cmd skills list could then also show source + whether upstream has moved.

Part 1 is the load-bearing piece -- without provenance, no update verb is possible. Backfill for already-installed skills can be manual (prompt on first update, or accept a spec argument to re-pin).

Tested on v1.5.0 (macOS); docs at commandcode.ai/docs/skills confirm only add/list/remove exist.

Commencez par les points d’entrée existants cmd skills add, list et remove, puis comparez la gestion de la provenance dans settings.json utilisée par cmd mods update. C’est terminé lorsque les installations préservent la spécification source et le SHA du commit, tandis que cmd skills update [skill-name] et --all peuvent récupérer à nouveau et écraser les skills installées ; consultez la documentation des skills pour connaître l’interface de commandes actuelle.