feat: support manifest-based distribution updates

[Tantanz20020918]

Summary

Allow an optional extension provider to select a stable distribution manifest while the CLI owns version checks, verified artifact downloads, and coordinated CLI and Skills updates. Existing package-manager update behavior remains unchanged when no manifest is configured.

Changes

• Add the optional DistributionProvider contract and lifecycle guidance in extension/transport
• Add manifest parsing, artifact download, SHA-256 verification, archive preparation, and rollback-capable installation in internal/distribution
• Integrate manifest targets with the asynchronous update cache and lark-cli update check/install paths
• Report the active distribution through lark-cli doctor and keep Skills state scoped to its source identity

Test Plan

• make unit-test passed
• make quality-gate passed
• local HTTP install-and-upgrade E2E passed (1/1 flow)
• manual verification: lark-cli update --check --json followed by lark-cli update --json upgraded a local fixture from 1.0.1 to 1.0.2 and synchronized three Skills directories

Related Issues

N/A

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 8f0658ff-e20d-438b-8beb-4975677e8361

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}