v0.5.4: Score a suite qikly did not write, and say which qikly, when, and where it is standing

Added

• qikly --install-skill now installs where your project says your agent
  is. It wrote .claude/skills/ and nothing else, so somebody working in
  Cursor got a directory their editor does not read, no error, and no hint
  that three other conventions existed. It now looks for .claude/,
  .agents/, .cursor/ and .gemini/, writes to whichever are there, says
  which it chose, and falls back to Claude Code's path plus the cross-agent
  one when a project shows no sign either way. Never both Gemini paths at
  once, which is what makes Gemini CLI warn about every skill overriding
  itself.
• qikly --score-code PATH --score-tests PATH scores a suite qikly did not
  write. It needed a task file and a converged run, which is the least likely
  thing a newcomer has: everyone has a suite before they have anything else.
  Point it at code and tests you already have and it plants faults and reports
  what your tests would not have noticed. Free, no model call, nothing of yours
  modified, and the report is written beside your code rather than into qikly's
  project. Found by watching an agent that had read --help, could not use the
  flag, and wrote its own mutation harness instead.
• Every command that does work now opens with a stamp: the version, the
  date and time, and the directory it was run in. A user reports a problem by
  sending a photograph of their terminal, and until now 0.4.6 and 0.5.3 printed
  identically, so the first reply was always a round trip asking which version.
  --validate --json is unchanged, because that output is parsed.
• It says when the project root is somewhere else. qikly moves to a
  resolved project root at startup, so a command run in one directory can
  operate on files in another, and nothing said so. That has now caused a sweep
  that wrote into the wrong tree, a test that scored the wrong project, and a
  first-time user who could not find files the tool had just reported creating.
• --init, --example and --demo refuse to run inside demo/<timestamp>/
  and say where to go instead. The demo runs there so it touches nothing of
  yours, which also means everything in it is thrown away; someone who has just
  watched it work is standing in something that looks exactly like a working
  project. Reported by a first-time user.

Fixed

• tools/release_check.py reported the Skill missing when run from
  anywhere but the repository root. One check used a bare relative path where
  every other resolves against the repository, so a release could fail for a
  reason that was not true.
• An installed Skill never updated itself and nothing said so. pip install --upgrade qikly replaces the package and cannot touch a folder copied into
  your project, so an upgrade left you following instructions that name a
  different set of commands. Any qikly command now says when the Skill it finds
  in the directory you are standing in is older than the one it ships, and what
  to run about it. Silent when it is current.
• --init and --example now say so before filling your home directory.
  A first-time user ran --example in his home folder and finished with
  inputs_private/, outputs/, a module and a demo/ tree sitting beside
  Documents, Downloads and Dropbox, then could not tell which of two
  identical-looking trees was his project. Warned rather than refused, since
  nothing there overwrites anything.
• The upgrade notice stopped repeating itself after instant commands. It
  prints once at the start and again at the end, because a run takes minutes
  and the first line scrolls away. On --validate, which returns in under a
  second, that put the same sentence twice in a four-line output.
• Upgrading left you with the previous release's Skill, silently.
  pip install --upgrade qikly replaces the package and cannot touch a Skill
  already copied into your project, so an upgrade left you following
  instructions that name a different set of commands. --install-skill said
  "already exists, nothing was changed" whether your copy was identical or
  three releases behind. It now says when yours is older and what to do.
• qikly --by week on its own started a real, billed run, the fourth flag
  with this defect. It was left out of the guard on purpose, because it carried
  an argparse default and a value the user typed was indistinguishable from the
  one argparse supplied. That reasoning was right about the symptom and wrong
  about the fix: the default now lives in the handler and the flag is guarded
  like every other. The test written to catch this class missed it, because it
  probed every value-taking option with the string "x" and argparse rejects
  that before the code under test is reached. It now probes with a value each
  option accepts.
• qikly --json on its own started a real, billed run, the third flag with
  this defect and the one three separate audits walked past. --html has had
  this check since it shipped; --json sits beside it and never did.
• A directory link that loops back on itself hung the workspace copy and
  produced a wall of nested OS errors. The cycle guard added for this covered
  the file count and not the copy, which protects nothing. It now refuses, and
  names the link.
• qikly --artifacts-url ... on its own started a real, billed run, the
  same unguarded fallthrough as the one below, in the sibling flag nobody
  thought to check. Found by auditing the fix for the first one.
• qikly --score-mutants 5 on its own started a real, billed run. Neither
  --score-mutants nor --score-seed triggers the scoring path by itself, and
  neither was listed in the guard that refuses an option with nothing to attach
  to, so control fell through to the ordinary run. Found by an audit that
  reproduced it by accident and spent money doing so.
• A demo directory made with --demo-dir was invisible to the guard that
  stops you building a real project inside a throwaway copy. That guard matched
  on the path's shape, and --demo-dir ./try-it produces try-it/<timestamp>/
  with no demo component anywhere, which is the combination the help text
  itself recommends. Every demo directory now carries a marker file saying what
  it is.
• The saved report still told you to converge a run you never started. The
  console message was made mode-aware and the report file was not, and the
  report is the artefact people keep and paste into a pull request.
• --install-skill gemini implied that path had been watched loading. It
  has not: Gemini CLI also reads .agents/skills/, and that is the one that
  was observed. The message now names what was tested per path rather than per
  tool.
• The demo marker had no way out. A kept demo folder blocked --init,
  --example and --demo for every directory beneath it, with a message that
  never named the hidden file responsible. The refusal now says how to undo it,
  and a marker that cannot be written says so rather than failing silently.
• A symlinked subdirectory slipped past the size ceiling on the workspace
  copy: the count did not descend into it and the copy dereferenced it, so a
  project with a linked virtualenv was counted as a handful of files and then
  copied whole.
• --install-skill all printed "That is the path all documents for skills",
  substituting the target name where an agent name belongs, and implying one
  path when it writes four.