feat: support branch refs in skill install/update sources

[Strernd]

Summary

• add #ref parsing support for install sources across GitHub shorthand, GitHub/GitLab URLs, and git URLs
• persist ref in global/local lock entries and use it for restore/update/check flows
• make skills check and skills update query/update against the stored ref instead of hardcoded main
• keep manual update hints ref-aware (sourceUrl#ref)

Examples

• npx add-skill vercel-labs/agent-skills#my-branch
• npx skills add git@github.com:vercel-labs/agent-skills.git#my-branch

Tests

• pnpm test tests/source-parser.test.ts src/source-parser.test.ts tests/local-lock.test.ts

Notes

• left ThirdPartyNoticeText.txt out of this PR (build artifact change)

[Strernd]

Addressed both findings:

1. Root-level skill update source:

• runUpdate now avoids building owner/repo/ when skillPath === "SKILL.md".
• It now uses owner/repo for root skills and owner/repo/<path> only when a folder path exists.

2. GitHub anchor fragments mis-parsed as refs:

• tightened fragment-ref detection so GitHub fragments are treated as refs only for repo/tree URLs, not blob anchors.
• https://github.com/owner/repo/blob/main/README.md#L10 no longer sets ref.

Also added regression coverage:

• blob anchor not treated as ref
• trailing-slash shorthand (owner/repo/) parses as GitHub shorthand

Validation:

• pnpm test tests/source-parser.test.ts src/source-parser.test.ts tests/local-lock.test.ts (102 passing)

[Strernd]

Addressed the remaining coverage gap.

What changed:

• extracted update install-source construction into a pure helper: src/update-source.ts
• runUpdate in src/cli.ts now calls buildUpdateInstallSource(...)
• added direct unit coverage in src/update-source.test.ts

Key regression covered:

• skillPath: "SKILL.md" now directly asserts root-skill update source is owner/repo#ref (no trailing slash)

Validation:

• pnpm test src/update-source.test.ts tests/source-parser.test.ts src/source-parser.test.ts tests/local-lock.test.ts (107 passing)