Allow opting out of auto-update and of the automatic `bl skill init` after updates

bl currently self-updates silently and then unconditionally re-runs bl skill init, with no persistent way to opt out of either step.

What happens

1. Any command (e.g. a scheduled bl usage token-plan) triggers shouldAutoUpdate() when the installed version is a major behind, or more than 3 minors behind (packages/runtime/src/utils/update-checker.ts). It then runs npm install -g bailian-cli@latest in the middle of the user's command.
2. On success, syncAgentSkillsAfterUpdate() runs bl skill init, which symlinks every bailian-* skill into every detected agent directory (~/.claude/skills, ~/.codex/skills, ~/.config/opencode/skills, ~/.pi/agent/skills, ~/.agents/skills, …). bl update does the same via updateAgentSkill() (packages/commands/src/commands/update.ts).
3. The only gate is ctx.settings.quiet, which comes from the per-invocation --quiet flag and is not a config.json key (packages/core/src/config/loader.ts), so it cannot be made persistent. bl skill init itself has no flags to limit targets.

Why this is a problem

Users who manage their agent skill directories elsewhere (dotfiles, a config-as-code repo) have their removals silently reverted on the next update. In my case 10 skills I had removed came back into five agent homes because a cron-style quota probe happened to run after 1.24.0 was published (telemetry: skill init at 2026-09-11T13:48:04Z, cliVersion 1.24.0, immediately after an in-flight 1.20.0 usage token-plan).

Request

Two independent, persistent switches (config.json key and/or env var), e.g.:

• BAILIAN_AUTO_UPDATE=0 / "auto_update": false — never run npm install -g implicitly; only print the "update available" notice.
• BAILIAN_SKILL_SYNC=0 / "skill_sync": false — never run bl skill init implicitly after an update (both the auto path and bl update).

Optionally, bl skill init --agent <list> so the sync can be scoped even when enabled.

Environment: bl 1.24.0, npm global install, macOS 26.6, node v26.8.2.

从 packages/runtime/src/utils/update-checker.ts 和 packages/core/src/config/loader.ts 开始，追踪自动更新和持久化设置，然后检查 packages/commands/src/commands/update.ts 以及 bl skill init 入口点。验证这两个开关能独立阻止隐式 npm 更新和技能同步，同时保留更新通知和显式技能初始化行为。