Re-land packaged agent skill sync safely

[andrei-hasna]

Re-lands the reviewed PR #90 source package change after revert PR #91, directly on merged main.

Fixes the two bounded resource-copy findings for OPE2-00283:

• existing unmarked directories without SKILL.md are skipped byte-for-byte with and without force;
• managed updates and explicit force adoption use a staged exact mirror, remove stale resources, and restore the original directory if the swap fails.

Validation on the exact candidate tree:

• focused sync/resource/installer/plan/pack/release tests: 101 pass, 0 fail;
• full suite: 1085 pass, 0 fail;
• typecheck and build: pass;
• release guard: 565 package-visible files certified;
• npm dry-run pack manifest: 565 entries, including agent-skills/inbox/scripts/inbox and agent-skills/skill-goal-execute/SKILL.md;
• staged and branch-history gitleaks scans: no leaks found.

This PR is intentionally held for the fixed reviewer and live station evidence. Do not merge, publish, install, mutate manifests, or roll out from this PR yet.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — fixed focused re-review, PR/code candidate only

Exact head: 148129ad6e7f2fa84570b535c964341cae0e1dfa
Base/current main: 483b9c8abcc8673efd8c374db2271366da3ed8ba
Candidate tree: 26f530c594cbe7a959185551f018f652204cca5b

Identity: commit 26274018… has parent 483b9c8a… and tree 1141c3f064b366cb1360fba0d1a46288c383425b, exactly matching originally reviewed 063229cb…; remediation commit 148129ad… is its child. Both commits use canonical author/committer identity, exactly one Agent: cossus, and no Co-Authored-By. PR is MERGEABLE/CLEAN; CI is SUCCESS; baseRefOid still equals current main.

Frozen P1(1) closed. Independent exact-head probe:
NO_SKILL_MD force=false action=skip helper=USER_BYTES marker=false skill_md=false
NO_SKILL_MD force=true action=skip helper=USER_BYTES marker=false skill_md=false
Supported force adoption remains intact:
FORCE_ADOPT action=update helper=BUNDLED_BYTES obsolete_exists=false marker=true

Frozen P1(2) closed. Independent exact-head probes:
MANAGED_MIRROR first=create second=update obsolete_exists=false current_exists=true
ROLLBACK thrown=synthetic swap failure rename_count=3 skill=adapted-v1 original=ORIGINAL_BYTES replacement_exists=false staging_count=0

Independent affected-lane run: 86 pass, 0 fail. Worker evidence: focused 101/0, full 1085/0, installer recheck 62/0, typecheck/build/release guard rc=0, package manifest 565 entries with bundled resources, staged and two-commit history scans no leaks found, CI ci pass 2m39s.

Verdict scope: PR #92 code may advance/merge. Overall @hasna/skills@0.1.61 release acceptance remains held for fixed-reviewer inspection of the final migration/rollout manifest and exact station02 then station01 publish/install/sync/rollback evidence. No additional blind review is required.