feat(ampup): add skills subcommand to install amp agent skills

[LNSD]

Agent skills in the amp repository are not release assets and link docs that live elsewhere in the repository, so ampup reads them from the source tarball of a git ref and bundles those links into self-contained skill directories.

• Add ampup skills add|list|update|remove for Claude Code, Codex, and Cursor, in the project or --global, defaulting to the skills of the active ampd version and pinnable with --ref or --pr <number> (the pull request head commit)
• Copy files linked from SKILL.md frontmatter metadata.references/assets into references/ and assets/, and record repo, ref, and commit in an .amp-skills.json lock file so skills ampup did not install are never touched
• Validate skill names as single path components so a tampered lock file or --skill value cannot reach outside the skills directory, and record the lock entry before installing so interrupted installs are retried
• Print results to stdout as text or --json, status to stderr, confirm remove unless --force, and print error causes from the top-level handler
• Add GitHubClient::resolve_commit, resolve_pull_request_head, and download_source_tarball, which streams the tarball to an anonymous temporary file read in two passes, plus typed thiserror errors and end-to-end tests against a mock GitHub API

Closes edgeandnode/amp#3131