Upgrade/reinstall: deleted files linger in installs (billing.py resurrectable); installed:<hash12> not human-mappable

Migrated from the pre-public development archive (issue #133 there); archive PR/issue numbers in the body refer to that archive.

Pre-flip audit (upgrade/reinstall lens), MEDIUM, not gating. Two related residuals:

1. npx skills add copies skills/ci-speedup/ recursively with no prune, so a user upgrading over an older install keeps files deleted since (today: scripts/billing.py — the entire pre-punt dollar engine, fully functional — and references/runner-rates.json). Inert at HEAD (no live import; tombstones in docs), but an upgraded install equals no single commit's tree, and the dollar engine sits one direct invocation from resurrecting the deliberately-stripped $-surface. Pruning is an upstream installer ask; until then, document "remove + re-add" as the upgrade path (README/SKILL install note).

2. Reports stamp installed:<hash12> — a lockfile folder-content hash, not a commit sha or CHANGELOG version. A maintainer triaging a stale-install bug report can't map the hash to a release without recomputing folder hashes, and (1) means an upgraded install's dir may hash to nothing. Consider a committed hash→release table or an additional human-readable version line.