feat: expand agent skill management

[chaim0m]

Summary

• add dci skill list with byte sizes and estimated token counts
• add dci skill update [agent] with local-edit protection and --force
• add --dir for non-standard agent configuration locations
• add dci skill --all for every detected supported agent
• keep installation idempotent and preserve existing install commands

Part of #13. Ambient customer, anomaly, and budget context is intentionally deferred because it needs a bounded API aggregate rather than multiple hidden client calls.

Test methods

Automated validation run on this branch:

go test ./...
go vet ./...

Manual validation in a disposable directory:

go build -o /tmp/dci-pr35 .
skill_dir=$(mktemp -d)
/tmp/dci-pr35 skill list --json | jq
/tmp/dci-pr35 skill codex --dir "$skill_dir"
echo 'local edit' >> "$skill_dir/skills/dci-cli/SKILL.md"
/tmp/dci-pr35 skill update codex --dir "$skill_dir"
/tmp/dci-pr35 skill update codex --dir "$skill_dir" --force

The first update should protect the local edit and refuse to overwrite it. The explicit --force update should restore the embedded skill.

Observed smoke test: the embedded payload contains 7 files, 18,804 bytes, and approximately 4,703 tokens.

Could this break things?

Risk: low-medium. This only writes inside a selected agent skill directory and does not call DCI APIs or touch customer data. Normal updates refuse to overwrite local edits. The main overwrite risk is an operator deliberately using --force or selecting the wrong --dir.