feat(skills): migrate from skills.sh skills-lock.json

[rgdevme]

Summary

• New subcommand agnos skill migrate [path] imports skills declared in a
  skills.sh skills-lock.json (default ./skills-lock.json) into
  agnos.json#skills + agnos.lock.json.
• The migration groups entries by repo so each upstream is fetched once,
  discovers each named skill via SKILL.md, re-hashes locally with
  hashSkillDir, and suffixes name collisions (foo-2, foo-3, …).
• Skills that can't be located in their upstream repo are skipped with a
  warning rather than failing the whole migration.
• agnos init now detects a sibling skills-lock.json and offers to
  migrate (defaults to yes). Under -y it logs a hint and skips.

Why

Users adopting agnos from skills.sh need a one-shot path to convert their
existing lockfile without hand-editing agnos.json + agnos.lock.json
and re-fetching each skill.

The upstream skills-lock.json stores only { source, sourceType, computedHash } per name — no in-repo path — so the migration has to fetch
each repo to discover where each named skill actually lives.

Behavior

• Input: ./skills-lock.json (or positional override).
• Output: writes agnos.json#skills (composite refs like
  github:owner/repo/in-repo/path) and agnos.lock.json (fresh local
  hashes); materializes each skill under .agnos/skills/<name>/.
• --dry-run: logs intent, writes nothing, makes no network calls.
• --no-install: skips per-agent dispatch (agnos init uses this
  internally and lets the trailing reinstate pass handle materialization).
• Idempotent: re-running is a no-op when nothing's changed.