Allow opting out of auto-update and of the automatic `bl skill init` after updates

bl currently self-updates silently and then unconditionally re-runs bl skill init, with no persistent way to opt out of either step.

What happens

1. Any command (e.g. a scheduled bl usage token-plan) triggers shouldAutoUpdate() when the installed version is a major behind, or more than 3 minors behind (packages/runtime/src/utils/update-checker.ts). It then runs npm install -g bailian-cli@latest in the middle of the user's command.
2. On success, syncAgentSkillsAfterUpdate() runs bl skill init, which symlinks every bailian-* skill into every detected agent directory (~/.claude/skills, ~/.codex/skills, ~/.config/opencode/skills, ~/.pi/agent/skills, ~/.agents/skills, …). bl update does the same via updateAgentSkill() (packages/commands/src/commands/update.ts).
3. The only gate is ctx.settings.quiet, which comes from the per-invocation --quiet flag and is not a config.json key (packages/core/src/config/loader.ts), so it cannot be made persistent. bl skill init itself has no flags to limit targets.

Why this is a problem

Users who manage their agent skill directories elsewhere (dotfiles, a config-as-code repo) have their removals silently reverted on the next update. In my case 10 skills I had removed came back into five agent homes because a cron-style quota probe happened to run after 1.24.0 was published (telemetry: skill init at 2026-09-11T13:48:04Z, cliVersion 1.24.0, immediately after an in-flight 1.20.0 usage token-plan).

Request

Two independent, persistent switches (config.json key and/or env var), e.g.:

• BAILIAN_AUTO_UPDATE=0 / "auto_update": false — never run npm install -g implicitly; only print the "update available" notice.
• BAILIAN_SKILL_SYNC=0 / "skill_sync": false — never run bl skill init implicitly after an update (both the auto path and bl update).

Optionally, bl skill init --agent <list> so the sync can be scoped even when enabled.

Environment: bl 1.24.0, npm global install, macOS 26.6, node v26.8.2.

packages/runtime/src/utils/update-checker.ts と packages/core/src/config/loader.ts から始めて自動更新と永続設定を追跡し、次に packages/commands/src/commands/update.ts と bl skill init のエントリポイントを調べます。2 つのスイッチによって、暗黙的な npm の更新とスキルの同期がそれぞれ独立して防止される一方で、更新通知と明示的なスキル初期化の動作が維持されることを確認してください。