Remove .agr.json: replace per-directory metadata with lockfile

[kasperjunge]

Summary

Remove the .agr.json metadata file that agr writes inside each installed skill directory. All metadata it currently tracks (ownership, content hash, source, tool) should be derived from agr.lock instead.

Why

.agr.json pollutes skill directories. Many users don't gitignore .claude/skills/ etc., so agr's metadata file shows up in their version control. The lockfile (#497) will track the same information at the project root, making per-directory markers redundant.

Scope

• Stop writing .agr.json in fetcher.py / metadata.py
• Migrate all reads of .agr.json to use lockfile data instead
• Update _find_existing_skill_dir(), is_skill_installed(), conflict detection to use lockfile
• Add migration: read existing .agr.json files into lockfile on first agr sync, then delete them
• Update SDK Skill.content_hash to read from lockfile
• Depends on: lockfile (Lockfile: add agr.lock for reproducible installs #497)

🤖 Generated with Claude Code