cli: surface dependency graph in spm list/status

Summary

Phase 2 of #68 (depends on the lockfile schema sub-issue; independent of the resolver internals — can be developed in parallel against fixture lockfiles that already carry the new provenance field). Update read-only diagnostic commands to show transitive dependency provenance.

Scope

• spm list and spm status display which skills were pulled in transitively and by what (using the provenance field added to ai.lock).
• Keep output readable for the common case (no transitive deps) — only show graph info when it's non-trivial.
• Tests in tests/cli.rs covering both a flat lockfile (no transitive deps, unchanged output) and a lockfile with transitive entries (new provenance shown).

Out of scope

Populating the provenance field via real recursive resolution (separate sub-issue) — build/test this against hand-written fixture ai.lock files.

Relevant code

• src/cli.rs, src/lockfile.rs, tests/cli.rs

Part of #68.

Start in src/cli.rs and src/lockfile.rs to trace how spm list and spm status read and render lockfile data. Use the hand-written ai.lock fixtures described in the issue, then extend tests/cli.rs for flat lockfiles with unchanged output and transitive entries showing provenance. Done means both read-only commands display non-trivial transitive dependency information without adding graph output for flat lockfiles.