Scope skill lock files by install target

[cyhhao]

Summary

• Move default skill lock operations to project scope while preserving --global for user-level installs.
• Apply the same scoped lock semantics to add, remove, check, update, and selected-agent persistence.
• Migrate legacy global lock entries into a project lock only when the matching project skill directory exists.
• Update docs and e2e coverage for project/global lock isolation.

Tests

• npm test
• npm run build
• npm run test:e2e (196 passed, 1 skipped because the mutable production collection fixture returned not found)

Risk

• Existing project installs tracked only in the old global lock are migrated on first project lock read when the installed canonical project skill exists.