feat: `cmd skills update` -- record install source so skills can be updated

Beginne mit den vorhandenen Einstiegspunkten cmd skills add, list und remove und vergleiche anschließend die Behandlung der Herkunft in settings.json, die von cmd mods update verwendet wird. Erledigt ist die Aufgabe, wenn Installationen die Quellspezifikation und den Commit-SHA beibehalten und cmd skills update [skill-name] sowie --all installierte Skills erneut abrufen und überschreiben können; prüfe die Skill-Dokumentation auf die aktuelle Befehlsoberfläche.

Problem

cmd skills add does not record where a skill came from. Once installed, there is no manifest mapping skill name to source repo -- nothing in ~/.commandcode/ or the skill directory preserves the owner/repo[/path][@ref] spec used at install time.

Consequence: there is no way to update an installed skill from within the CLI. cmd skills only has add / remove / list (unchanged since v0.18.2). The only update path is:

1. Rediscover the source repo yourself (out of band -- the CLI can't tell you)
2. Re-run cmd skills add <owner/repo/path> -f

For skills installed from multi-skill repos or subpaths (e.g. cmd skills add acme/repo/path/to/skill), rediscovering the exact spec is genuinely error-prone.

Prior art

• Mods already solve this in Command Code itself: cmd mods update reinstalls and reconciles every configured mod package, because mod sources are tracked in settings.json. Skills are the odd one out.
• GitHub CLI shipped gh skill (v2.90.0, April 2026), which records provenance metadata at install time and supports gh skill update [name|--all] across agent hosts.

Proposal

1. At cmd skills add time, write the resolved source spec (owner/repo[/path][@ref] plus installed commit SHA) to a manifest -- either a skills.json alongside the skills directory or a per-skill metadata file.
2. Add cmd skills update [skill-name] and cmd skills update --all: re-fetch from the recorded source and overwrite in place (same semantics as add -f).
3. cmd skills list could then also show source + whether upstream has moved.

Part 1 is the load-bearing piece -- without provenance, no update verb is possible. Backfill for already-installed skills can be manual (prompt on first update, or accept a spec argument to re-pin).

Tested on v1.5.0 (macOS); docs at commandcode.ai/docs/skills confirm only add/list/remove exist.