feat(cli): remote built-in skills manifest

[codeaholicguy]

Summary

• load the live built-in skill list from a hand-maintained bare JSON array on main
• share one manifest fetch promise across built-in flows in each CLI process
• validate the complete remote list and fall back to the bundled current set with a clear warning
• migrate init, skill add --built-in, setup, and status from the compiled constant

Product goal

Maintainers can add a skill directory and update skills/built-in.json on main, making the new built-in available to existing CLI versions without publishing a CLI release.

Failure and validation semantics

The loader accepts only a non-empty array of unique, valid, non-empty skill-name strings. Network, HTTP, JSON, or validation failures warn and use the bundled current list so setup and status remain usable offline.

Validation

• npm run build — 6 projects passed
• npm test -- --parallel=1 / equivalent serial Nx target — 6 projects, 2177 tests passed
• npm run lint — 6 projects passed (2 pre-existing warnings)
• npx vitest run --config e2e/vitest.config.ts — 41 tests passed
• npx ai-devkit@latest lint --feature builtin-remote — passed

A shared /tmp quota caused intermittent -122 write errors in an unrelated plugin-loader test during parallel retries; the complete serial suite passed without code changes.