feat(cli): graduate install and sync from experimental

Summary

Graduates the lock-file restore and npm sync commands out of experimental_ for v1.9.

 skills --help / banner / README / docs/commands.md
-  experimental_install   Restore skills from skills-lock.json (alias: install, i)
-  experimental_sync      Sync skills from node_modules (alias: sync)
+  install                Restore skills from skills-lock.json (alias: i)
+                         With a package, works like add
+  sync                   Sync skills from node_modules into agent directories

cli routing (unchanged behavior)
  install | i  (no source)    -> runInstallFromLock
  install | i  <source>       -> runAdd
  experimental_install        -> runInstallFromLock   # kept as a compatibility alias
  sync | experimental_sync    -> runSync              # kept as a compatibility alias

• README: the collapsed "Experimental Features" block becomes "Sync Skills From npm Packages" and "Restore Project Skills" sections. The commands are also listed in the command table.
• docs/commands.md: skills sync and skills install are top-level sections. The #skills-sync anchor is kept, and a new #skills-install anchor is added.
• The sync intro banner now says skills sync.
• Tests and e2e now use the new names. Alias coverage stays in place: it.each(['sync', 'experimental_sync']), experimental_install in add.test.ts, and --help routing for both old names.
• The telemetry event name stays experimental_sync so existing analytics keep working. If we want it renamed, that can be a follow-up.

Evidence

• Before: skills --help lists experimental_install / experimental_sync, and the banner shows npx skills experimental_sync. After: skills --help lists install / sync, and the banner shows npx skills install and npx skills sync. Updated tests check this (advertises sync in help output, advertises sync in banner).
• pnpm type-check, pnpm format:check and pnpm build pass. The tsnapi snapshot is unchanged.
• pnpm test: 1248 tests pass. detect-agent and use need agent/proxy env vars unset to pass when run from inside a coding agent; that is unrelated to this change.

Merge Danger

Door: two-way

The old names still route to the same handlers, so no existing scripts or prepare hooks break.

Blast Radius: docs

Only help text, banner and docs change. Command behavior and the public API stay the same.