e2e: cover remote built-in skill update and index paths

[codeaholicguy]

Current coverage

E2E covers a relative local registry and project skill removal, but remote/built-in installs, registry refresh, search index, and global/environment variants are absent.

What is missing

• init --built-in and skill add --built-in live-manifest and offline fallback paths
• Remote Git registry add/install and conflict/--force
• skill update [registry-id] fresh pull, dirty cache, and stale-cache fallback
• skill find --refresh ranking and stale-index behavior
• skill rebuild-index --output determinism and malformed registries
• Global and --env add/list/remove behavior

Risk ranking

High, rank 6: release 0.61.0 moved built-in discovery to a live manifest, while current E2E uses only a local fixture.

Recommended E2E tests

• Intercept or inject an unreachable manifest URL, run init --built-in, and assert bundled skills install with a warning.
• Use a local bare Git remote to test skill update, stale-cache fallback, find --refresh, and deterministic rebuild-index --output.

Acceptance criteria

• The checklist tests are merged under e2e/.
• Tests use local Git/network boundaries and an isolated HOME.
• Installed files, config entries, warning text, and deterministic index contents are asserted.

Related audit findings

No direct A/C defect beyond the audit recommendation for package and operational diagnostics; this gap masks regressions in the remote built-in behavior described in release 0.61.0.