fix(installer): deduplicate shared skill discovery

[3metaJun]

The installer created independent skill copies in directories that OpenCode and pi also discover, so old native copies and backups could shadow a shared update.

Install one canonical copy for Codex, OpenCode and pi, and keep Claude's adapted copy without name, using its supported directory-name fallback. Add explicit local --migrate --replace migration for recognized legacy copies, backups and interrupted stages, with preserved originals and rollback. Keep transaction data outside discovery roots, validate physical path aliases, and retain native agent destinations. SSH installs deduplicate compatible targets; migration itself runs locally on the target machine.

Incorporates the shared installer/smoke target-resolution idea from #17, fixing smoke checks that still inspected the old pi/OpenCode directories. Keeps the discovery, migration and rollback behavior described above. Prepares version 0.4.1 and its upgrade notes.

Closes #16.

Validation:

• npm test: 205 passed, 1 Unix-only test skipped on Windows. npm run check-package passed.
• Regression coverage for fresh installs, partial updates, repeat runs, migration ownership, rollback, aliases, custom targets and mocked SSH transport.
• Two consecutive installs in an isolated home, followed by real discovery in Claude Code 2.1.267, OpenCode 1.18.30 and pi 0.85.1. Claude kept the command name; OpenCode and pi each found one shared copy without duplicate diagnostics. No model requests were sent.

---

Model: GPT-6
Harness: Codex