fix(install,uninstall): refresh MCP skills on install, add teardown prompts

[geodro]

Two install-time/uninstall-time asymmetries surfaced while looking at the state of a machine after lerd uninstall && lerd install.

Install never wrote MCP skills. Those were only refreshed by lerd update (which calls refreshGlobalMCPSkills / refreshProjectMCPSkills at its tail). After a reinstall, ~/.claude/skills/lerd/SKILL.md, ~/.cursor/rules/lerd.mdc, ~/.junie/guidelines.md, and each registered site's equivalent files stayed pinned to whatever version the binary was when lerd update last ran — which could be days or weeks stale relative to the currently-installed binary. The same two function calls now run at the end of runInstall, using the existing opt-in semantics (global refreshed only if Claude Code user-scope MCP is registered; per-project only for directories that already have lerd markers).

Uninstall was the mirror of that problem: it stopped and removed containers, the podman network, and the binary itself, but intentionally left user artefacts behind. That's the right default for config/data/site files, but there's a class of artefacts the user may legitimately want cleaned up — they're lerd-specific, easy to lose track of, and regenerate on next install. Three opt-in prompts added (all default no; --force implies yes to all for parity with the existing removeData prompt):

• "Remove MCP integration" — new RemoveGlobalAISkills + RemoveProjectAISkills run across every registered site. Drops Claude Code user-scope MCP registration, deletes SKILL.md / lerd.mdc, removes the "lerd" entry from shared mcp.json files while preserving other servers, and strips the <!-- lerd:begin -->…<!-- lerd:end --> block from .junie/guidelines.md while preserving surrounding user content.
• "Uninstall mkcert CA from system trust stores" — runs mkcert -uninstall so browsers and OS trust stores stop trusting the lerd CA that install originally added via mkcert -install.
• "Purge lerd-built container images" — removes lerd-php*-fpm:local, lerd-custom-*:local, and lerd-dnsmasq:local. Upstream pulled images (mysql/redis/postgres/meilisearch/rustfs/mailpit/frankenphp/stripe-cli/…) are deliberately left alone because they're expensive to re-pull and user data lives in host bind mounts under ~/.local/share/lerd/data/, not inside the images.

New shared helpers (removeMCPServerEntry, stripJunieLerdSection, isLerdBuiltImage) are pure enough to test without podman or a real filesystem. Round-trip tests confirm Write/Remove symmetry for both global and project scopes, and that preserving unrelated MCP servers + user content in guidelines.md works correctly. On macOS everything routes through the same services.Mgr / filesystem paths; mkcert -uninstall and claude mcp remove are platform-agnostic CLIs.