Adding support for skills.sh installer

[faorfwd]

⚠️ Breaking changes

Replace the commands catalog with skills, add cross-harness publishing

What & why

Commands and disable-model-invocation: true skills behave identically to the user (/name,
explicit only). This PR converts the built-in spec/tech/tasks/implement/verify/prevalidate/architecture/hire flow into skills, adds a
kyos-setup skill, and publishes all of it via .claude-plugin/marketplace.json — so the flow can now install into any of the 50+ harnesses npx skills add supports, not just Claude Code.

Two follow-on problems that portability created, and how they're handled:

• Cross-harness "explicit only" needs two signals. Codex ignores frontmatter and reads a sidecar agents/openai.yaml instead — each skill now ships both.
• ⚠️ npx skills update has no local-edit detection (tree-hash reinstall, full stop) — so customization moved to .claude/skill-overrides/, a folder neither installer touches. This also absorbed project-context.md, which previously only existed in kyos-cli installs and would silently go missing under a bare npx skills add install.

Design doc: docs/execution/vercel-skills-source/{spec,tech,tasks}.md.

Breaking changes

• catalog/claude-base/claude/commands/ is gone. Existing repos keep their old
  .claude/commands/*.md wrapper stubs (kyos never deletes repo-owned files), but the managed
  files they point to no longer regenerate — --doctor will flag them stale. Manual cleanup,
  by design.
• .claude/commands/project-context.md is retired, replaced by
  .claude/skill-overrides/_shared.md. Anyone with local edits there needs to move them by hand.
• --doctor drops the per-command byte-level report. Checksum integrity checking is unchanged; only the friendlier report is gone.
• Skill names are bare (spec, not kyos:spec) — accepted collision risk if installed
  alongside a same-named third-party skill. kyos-setup is prefixed since it's a generic name.