[huija]

This branch collects four behavior changes and their fixes, each with tests and documentation.

Discover skills wherever a repository puts them

get only looked at the repository root and below skills/, so a repository
that publishes its skills directly in the root, or under an agent directory
such as .agents/skills or .claude/skills, was reported as having no SKILL.md
at all. Discovery now scans the repository root, the conventional skills/
collection at any depth, every hidden <name>/skills collection, and the
root-level directories, in a fixed precedence order, collapsing duplicates.
An explicit subdirectory still wins over a name.

Complete a bare owner/repo address with github.com

A bare path like openai/skills used to become https://openai/skills, which
only resolves when the first segment happens to be a host. A two-segment path
whose first segment carries no dot is now completed with github.com, so
skillmod get openai/skills//gh-fix-ci works; a dotted first segment stays a
host, ports and Windows drive letters are left alone, and filesystem paths are
untouched. A fetch that fails names the URL it was resolved to.

Remove by repository

remove only accepted skill names and aliases, so clearing everything that
came from one repository meant naming each skill. A positional argument that
contains a / — which a skill name can never do — is now a repository
selector: one entry needs no choice, several are offered interactively exactly
like get offers a repository's skills, a non-interactive run lists them for
a rerun, and --all takes every entry the repository declares. The --agent
unlink path resolves the same selectors to names.

One document under --json

--json used to print the human summary on stderr alongside the document on
stdout, and a command that failed early printed no document at all. Every
human-readable channel is now closed in that mode — no summary, no progress —
and exactly one document is written whatever happens, with an error field
naming the failure and the exit code unchanged. entries always marshals as
an array. Only a cobra usage error keeps plain text on stderr, because no
command ran to produce a report.

Adopt skills added outside skillmod with sync --adopt

Skills that appear in the installation directory after a manual copy, an npx
install, or a hand edit used to be invisible to sync: no declaration, no
baseline. sync --adopt declares each one as a local entry with its current
content as the lock baseline, the same thing init does for a machine's
existing skills. No file is rewritten, so a later edit shows up as local drift
instead of being reset. A plain sync only names them and points at the flag,
--dry-run plans without asking, and --check refuses the combination
instead of silently ignoring it.

Other fixes

• init on a machine with no existing skills claimed an empty manifest it had
  not written, because the non-interactive confirmation gate sat before the
  write phase. The gate now applies only when there is something to confirm.
• Missing-manifest advice is split by scope: a project without one usually
  means the wrong directory, so the advice offers --global before suggesting
  init.
• list answers from the cached reference snapshot younger than fifteen
  minutes, which keeps list --global fast; update remains the command that
  deliberately refreshes.
• The README pair and the agent skill are rewritten in plain language, and the
  references cover the address grammar, the discovery layouts, the freshness
  window, the repository selector, sync --adopt, and the one-document --json
  contract.

make check, go test -race, govulncheck, the cross-platform test matrix,
and all six release cross-builds pass on this branch.