Add provenance-aware adoption for flat skills and skillsets

[jon-devlapaz]

Problem

Most existing flat library entries have no .tink-source.json, and Tink has no safe workflow for replacing matching flat project installs with an authoritative skillset. Manual deletion or asserted provenance would bypass drift and rollback guarantees.

Missing provenance should remain supported, but it must be visible and adoptable only with evidence.

Relevant code: src/provenance.rs, src/library.rs, harvest/import paths, and skillset installation.

Proposed change

Add read-only planning before mutation:

tink skillset plan NAME-skillset --adopt

Classify each colliding flat skill as:

• exact pinned match;
• local drift;
• missing;
• unowned/unprovenanced.

Then support an explicit atomic skillset add ... --adopt that moves only exact-pinned matches, stages the complete set first, retains rollback state until success, and refuses all drift by default.

Also add a flat-library adoption command that writes provenance only after cloning the exact source/revision/path and byte-comparing the existing tree. Harvest may derive provenance automatically only when a canonical Git remote, immutable commit, and relative path can be proven.

Consider a versioned provenance receipt with a body digest, while retaining backward compatibility.

Acceptance

• Planning performs no writes and reports exact/drift/missing/unowned separately.
• Adoption succeeds only for byte-identical pinned content.
• Drift refuses without modifying the project or library.
• Mid-operation failure restores the original flat state.
• Provenance cannot be asserted without equality proof.
• Legacy receipt-less skills remain usable and are reported as unprovenanced.

Priority

P1 — safe migration and provenance recovery.