feat(skill): install embedded Agent skill

[jamiesun]

Summary

• add sshx skill install with the canonical Agent Skill embedded in the binary
• support the default ~/.agents/skills/sshx target and custom --dir=<path> destinations
• add atomic writes, managed digest tracking, conflict preservation, explicit --force, and symlink rejection
• wire the command into the installer, Homebrew formula test/caveat, documentation, audit metadata, and release archives
• prepare release notes for v0.2.0

Why

Homebrew and go install previously installed only the sshx binary. Agents then needed a separate, manual Skill installation path, and the binary/Skill versions could drift.

User impact

After installing or upgrading sshx, users can run:

sshx skill install
sshx skill install --dir="$HOME/.codex/skills/sshx"

Existing unmanaged content is preserved unless --force is explicitly supplied.

Validation

• make check
• go test -race ./...
• make lint
• make build-all
• actionlint .github/workflows/*.yml
• shellcheck install.sh scripts/test_install.sh scripts/tag.sh
• bash scripts/test_install.sh
• mdbook build
• govulncheck ./...
• compiled-binary install/idempotency/conflict/symlink E2E coverage

Bugfix reflection

• Original gap: binary-only install paths did not provide a matching Agent Skill.
• Missing invariant: every released binary must carry and safely install its canonical Skill.
• Regression coverage: unit and compiled-binary E2E tests cover custom directories, idempotency, conflict preservation, explicit force, metadata, permissions, and symlink rejection.