feat(install): add neutral local library activation lifecycle

[ngaurav]

Summary

• Add an ASM-owned neutral local library under the config root so skills can be installed once without appearing in provider/global skill folders.
• Add asm install --library, asm library list, asm activate, and asm deactivate so library skills are explicitly linked into and removed from selected provider scopes.
• Add asm library update <skill> / asm library update --all to refresh centrally installed skills from recorded source metadata, including local root skills and GitHub/registry-backed library entries.
• Persist source type, repo-relative skill path, target library path, commit/ref metadata, and installed timestamps so updates use the originally discovered skill subpath.
• Guard duplicate installs, force behavior, Vercel-method leakage, path traversal, symlink escapes, stale activations, invalid refreshed metadata, and lock-write rollback.

Why

This moves ASM toward the desired local/private skill-library workflow: keep reusable skills in one central ASM location, then explicitly activate only the skills a project/provider should see.

It also preserves and uses the real discovered skillPath, avoiding the class of update bug described in rohitg00/skillkit#133 where update logic later looks in the wrong subdirectory.

Related Issues

• Refs [FEATURE] Local publish mode #307: neutral local/private skill library and explicit activation.
• Refs Add sandbox mode to selectively enable skills for agents #92: local activation/deactivation lifecycle via provider symlinks.
• Prepares Resolve shared skill dependencies during install #247: central storage and recorded skill-path metadata needed for dependency-aware installs.
• Related external bug: [Bug] sk update always fails 'no SKILL.md in source' for git sources — install stores subpath=skillName instead of the real path rohitg00/skillkit#133.

Test Plan

• npm test (53 files, 1821 tests)
• npm run typecheck
• Subagent spec and code-quality reviews for deactivate/update primitives and CLI commands

Notes

• --library --method vercel is rejected because the Vercel installer writes to provider skill folders, which would break the neutral-library guarantee.
• asm activate is symlink-only and requires explicit provider/scope selection.
• asm deactivate removes only symlinks that resolve into the ASM library; it refuses real directories and external symlinks.
• asm library update --all reports per-skill results and continues after individual failures.

[ngaurav]

@luongnv89 please have a look. The primary motivation is to have a local neutral folder (e.g. ~/asm/skills) so that when a skill is installed in a project we can just symlink it to the neutral location. This way I ensure I'm not copying the same files in all the projects. There are skills like superpowers which I install in multiple projects but not every project.

While implementing there were many other aspects which I discovered in the issues and therefore this is not a 1:1 solution for any individual issue.