[codex] Refactor Skillpack around provider-native skill management

[WTW0313]

Summary

Implements #2

• Rework core skill management around grouped inventory, configurable scan roots, provider-native availability, and provenance-aware skill identity.
• Add provider-specific Codex and Claude handling for local skills, plugin-owned skills, settings files, and fallback toggles while preventing mutations of shared Global Skill content.
• Reshape the TUI around the inventory experience with read-only Project Skills and Settings views, manual skills.sh update checks, skills.sh-only installs, and removal of skill authoring flows.
• Document the provider-native direction with ADRs, a PRD/spec, agent docs, and updated README/TUI guidance.

Why

Skillpack needs to distinguish skills that exist on disk from skills that are available to a specific agent. The old model leaned on filesystem layout and fallback directory renames too heavily, which breaks down for provider-managed configuration, plugin-owned skills, symlinked shared skills, and project-level skills.

This branch moves v1 behavior toward provider-native lifecycle management: read provider config during scans, route toggles through the owning provider when possible, reserve mutations for supported lifecycle actions, and treat shared or project skill content as read-only unless an external manager such as skills.sh owns the operation.

User / Developer Impact

• Inventory can now group related skill instances and expose scan/provenance details more clearly.
• Codex and Claude availability should better reflect provider-native config, including plugin-level ownership.
• Global skills are no longer disabled by renaming shared skill directories.
• Installs, removals, and updates are narrowed to skills.sh-managed global skills for v1.
• The TUI now includes dedicated Project, Settings, and Updates surfaces and no longer exposes create/authoring flows.

Validation

• pnpm build
• pnpm test