Track installed skillsets in the project catalog

[jon-devlapaz]

Problem

The project catalog under $TINK_HOME/catalog/by-project records standalone skills only. Skillset add, refresh, and remove do not update it, so the catalog is not a complete record of managed project dependencies.

Relevant code: src/catalog.rs, standalone deposit in src/add.rs, and skillset lifecycle operations in src/skillsets.rs.

Proposed change

Extend the project catalog schema backward-compatibly with first-class skillset records, including the skillset name and enough installed identity to relate it to its receipt.

Lifecycle behavior:

• add/no-op ensures the catalog record exists;
• refresh preserves or updates the record atomically;
• remove withdraws the skillset record;
• project destroy removes all related records;
• catalog listing distinguishes standalone skills from skillsets and members.

The catalog remains an index; the installed receipt remains authority for the exact pinned tree.

Acceptance

• Adding a skillset creates one typed project-catalog record.
• Refresh leaves a correct record after success and unchanged state after failure.
• Remove and destroy withdraw the record.
• Existing standalone-only catalog files continue to load.
• Catalog output cannot double-count members as standalone dependencies.

Priority

P1 — lifecycle bookkeeping.