Add safe managed skill uninstall

[dd3ok]

Summary

• add stash uninstall for verified inactive managed skills
• use operation-owned tree and record tombstones with fail-closed crash recovery
• document the contract and regenerate every vendor adapter

Safety

• reject active deployments, links, non-directories, and hash drift without mutation
• preserve external catalogs, source skills, host deployments, and host settings
• support stale-record cleanup when the managed tree is already missing

Platform impact

• use the existing Node.js rename and removal path on every supported platform
• CI passed on Ubuntu (Node 20 and 24), macOS (Node 24), and Windows (Node 24)

Verification

• npm run test:all (80 source tests passed, 1 existing Windows fixture skipped; 8 distribution tests passed)
• canonical and installed Codex skill validators passed
• npm run pack:check passed
• git diff --check passed