feat: `cmd skills update` -- record install source so skills can be updated

Problem

cmd skills add does not record where a skill came from. Once installed, there is no manifest mapping skill name to source repo -- nothing in ~/.commandcode/ or the skill directory preserves the owner/repo[/path][@ref] spec used at install time.

Consequence: there is no way to update an installed skill from within the CLI. cmd skills only has add / remove / list (unchanged since v0.18.2). The only update path is:

1. Rediscover the source repo yourself (out of band -- the CLI can't tell you)
2. Re-run cmd skills add <owner/repo/path> -f

For skills installed from multi-skill repos or subpaths (e.g. cmd skills add acme/repo/path/to/skill), rediscovering the exact spec is genuinely error-prone.

Prior art

• Mods already solve this in Command Code itself: cmd mods update reinstalls and reconciles every configured mod package, because mod sources are tracked in settings.json. Skills are the odd one out.
• GitHub CLI shipped gh skill (v2.90.0, April 2026), which records provenance metadata at install time and supports gh skill update [name|--all] across agent hosts.

Proposal

1. At cmd skills add time, write the resolved source spec (owner/repo[/path][@ref] plus installed commit SHA) to a manifest -- either a skills.json alongside the skills directory or a per-skill metadata file.
2. Add cmd skills update [skill-name] and cmd skills update --all: re-fetch from the recorded source and overwrite in place (same semantics as add -f).
3. cmd skills list could then also show source + whether upstream has moved.

Part 1 is the load-bearing piece -- without provenance, no update verb is possible. Backfill for already-installed skills can be manual (prompt on first update, or accept a spec argument to re-pin).

Tested on v1.5.0 (macOS); docs at commandcode.ai/docs/skills confirm only add/list/remove exist.

Bắt đầu với các entry point hiện có cmd skills add, list và remove, sau đó so sánh cách xử lý provenance trong settings.json được cmd mods update sử dụng. Công việc được xem là hoàn tất khi các lần cài đặt giữ lại source spec và commit SHA, trong khi cmd skills update [skill-name] và --all có thể tìm nạp lại và ghi đè các skill đã cài đặt; hãy kiểm tra tài liệu về skills để biết command surface hiện tại.