fix(cli): install skills with --copy so check sees a faithful, correctly-placed set (#1744)

`hyperframes init` / `skills` / `skills update` shelled out to `skills add`
without `--copy`, so the upstream CLI installed via its canonical
`.agents/skills` store + per-agent symlinks. That layout re-serialises each
SKILL.md's frontmatter, so an installed bundle no longer byte-matches the
published manifest — `skills check` reported a freshly-installed set as
outdated — and it didn't reliably land in the dir the agent reads
(e.g. `.claude/skills`).

Pass `--copy` in runSkillsAdd (the single chokepoint every install flows
through: bare `skills`, `update`, and `init` via installAllSkills) so real
files are written into each agent's skills dir — faithful to the manifest and
correctly placed.

Verified end-to-end: a fresh-content install now reads all-current in
`.claude/skills` (was all-outdated in `agent/skills`).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/cli/src/commands/skills.test.ts

@@ -109,13 +109,13 @@ describe("hyperframes skills", () => {
       "linux",
       "npx",
       ["--version"],
-      ["skills", "add", "https://github.com/heygen-com/hyperframes", "--all"],
+      ["skills", "add", "https://github.com/heygen-com/hyperframes", "--all", "--copy"],
     ],
     [
       "darwin",
       "npx",
       ["--version"],
-      ["skills", "add", "https://github.com/heygen-com/hyperframes", "--all"],
+      ["skills", "add", "https://github.com/heygen-com/hyperframes", "--all", "--copy"],
     ],
     [
       "win32",
@@ -130,6 +130,7 @@ describe("hyperframes skills", () => {
         "add",
         "https://github.com/heygen-com/hyperframes",
         "--all",
+        "--copy",
       ],
     ],
   ] as const)(

packages/cli/src/commands/skills.ts

@@ -57,7 +57,14 @@ function runSkillsAdd(
   source: string,
   opts: { cwd?: string; extraArgs?: string[] } = {},
 ): Promise<void> {
-  return spawnNpx(["skills", "add", source, ...(opts.extraArgs ?? ["--all"])], opts);
+  // `--copy` writes real files into each target agent's skills dir, instead of
+  // the upstream default (a canonical `.agents/skills` store + per-agent
+  // symlinks). That default re-serialises each SKILL.md's frontmatter, so an
+  // installed bundle no longer byte-matches the published manifest — `skills
+  // check` then reports a freshly-installed set as outdated, and the symlinked
+  // layout doesn't reliably land where the agent actually reads. Real copies
+  // keep the install faithful to the manifest and detectable by `skills check`.
+  return spawnNpx(["skills", "add", source, ...(opts.extraArgs ?? ["--all"]), "--copy"], opts);
 }
 
 // Skill names are kebab-case directory names. Refuse anything that isn't one