Add CLI-only optional EVO skills install lane

[middleDuckAi]

Summary

Add an optional CLI-only post-install lane for installing EVO skills into Evolution CMS projects.

Scope

• Add --skills flags in CLI mode only.
• Plan-first install flow for copy/link operations.
• Write core/custom/skills/.evo-skills.lock.json.
• No TUI selector in this MVP.

Acceptance

• --skills without --cli fails clearly.
• --skills-dry-run writes no target files.
• --skills-link requires local --skills-source.
• --skills-ref conflicts with --skills-link.
• Tests/evidence are kept under /Users/dmi3yy/PhpstormProjects/skills/orders/evo-install-skills.

[middleDuckAi]

Status update from middle:Duck.

The draft PR has been updated after the merged evo-skills manifest contract:

• Added installer-side manifest file_hashes parsing.
• Verified declared skill payload hashes before plan/apply.
• Wrote verified payload file_hashes into .evo-skills.lock.json.
• Added tests for copied agents/openai.yaml, declared payload hash mismatch, and missing declared payload files.
• Confirmed native Go smoke in the order demo workspace only:
  /Users/dmi3yy/PhpstormProjects/skills/orders/evo-install-skills/demo

Checks completed:

go test ./internal/engine/install
go test ./...
git diff --check

Native smoke completed:

• Dry-run: no skill target files and no lockfile written.
• Link mode: evo-skill-creator installed as a symlink with lockfile payload hashes.
• Copy mode: --skills=default --skills-ref=8ebbdb3 installed evo-skill-creator and evo-git-workflow as copied directories with SKILL.md, agents/openai.yaml, and lockfile file_hashes.

Governance note:

• Review gates are Duck, Lizard, Sokil, Udod, and a human operator.
• Forge is not a review gate and does not decide what enters the skill contract.
• Forge is represented by implementation artifacts that must pass the review chain.

Metadata note:

• The repository currently exposes only default labels.
• Creating canonical labels such as status::in-progress, area::skills, and review labels returned 404 with the available token/role.
• Labels could not be created or applied with the available token/role, so this comment records the expected governance until repo label permissions are delegated.

PR: #51

[middleDuckAi]

Workflow autoload proof was added to draft PR #51.\n\nNew installer commit: f60b68c add(skills): record workflow autoload evidence\n\nWhat is now proven in the order demo:\n- local skill connected: base-skill-cabbage\n- workflow_id resolved: base-skill-cabbage.autoload.v1\n- workflow order visible: Seed -> Gate -> Map -> Contract -> Action -> Evidence -> Promotion\n- lockfile records workflow version/hash and no_write_actions_executed=true\n- autorun=false and promotion_allowed=false\n- evoDemo remains untouched\n\nChecks:\n- go test ./internal/engine/install\n- go test ./...\n- git diff --check\n\nEvidence: /Users/dmi3yy/PhpstormProjects/skills/orders/evo-install-skills/reports/workflow_autoload_gate_2026-06-05.md\n\nStatus remains in progress until PR #51 is reviewed and merged.