Add catalog audit, exact pack reconciliation, and source provenance

[joshkennedy]

Problem

A vault can reliably sync an unhealthy active catalog: duplicate/conflicting names, invalid Agent Skills metadata, oversized aggregate descriptions, additive-only packs, and imported skills with no retained upstream provenance.

Proposed behavior

• Add skillsync audit [--json] to validate Agent Skills frontmatter, report duplicate/conflicting detected skills, and summarize active catalog size per target.
• Add skillsync pack apply <pack> --target <targets> --exact --dry-run so a pack can declaratively reconcile managed assignments while preserving unmanaged paths.
• Store optional source URL/ref/commit/subpath metadata for Git imports and add explicit, non-mutating skillsync update --check reporting.
• Surface catalog diagnostics through skillsync doctor.

Safety and compatibility

• Existing vault manifests remain valid; provenance fields are optional.
• Exact reconciliation defaults to dry-run unless explicitly applied and only changes SkillSync-owned assignments/projections.
• Unmanaged local folders are never deleted or overwritten.
• Upstream updates are never applied automatically.

I can send this as focused commits with tests if the direction sounds useful.