feat: track installed remote skills in boost.json on add-skill

[SagorIslamOfficial]

Issue: #701

This PR introduces skill tracking in boost.json. When you install skills using boost:add-skill, Boost now records each skill’s metadata under skills in boost.json. This makes it clear which skills came from which remote source and helps keep source mapping consistent.

Summary:

• Boost now tracks installed remote skills by source in boost.json.
• Skills are grouped by repository source instead of being stored as a flat list.
• Built-in framework skills are grouped under laravel/boost.
• Legacy skills formats are still read correctly and normalized into the current grouped format.

Example:

"skills": {
        "SagorIslamOfficial/agent-skills": [
            "composition-patterns",
            "react-best-practices"
        ],
        "anthropics/skills": [
            "algorithmic-art",
            "brand-guidelines",
            "claude-api"
        ],
        "laravel/boost": [
            "fortify-development",
            "inertia-react-development",
            "laravel-best-practices",
            "pest-testing",
            "tailwindcss-development",
            "wayfinder-development"
        ]
    }

Tests:

• source mapping is written when skills are installed from remote repositories
• config tracking behavior for grouped source mapping
• preservation of source metadata when syncing skills
• legacy list and legacy flat skill formats normalize correctly
• update command behavior remains stable with the new tracking format

Note: All relevant tests passed for this implementation, with no breaking regressions identified in the covered paths. I grouped all first-party skills under laravel/boost for better organization. Running boost:update will automatically format the skills into the new structure.

[pushpak1300]

Instead of adding new repositories key can you just not reuse the skills key with different way or maybe deprecate it and arrange in new format also why do we need hash in this case ? we just need the source ? we can just update the skill form source no need to check it right ?

"repositories": {
        "SagorIslamOfficial/agent-skills": {
            "sourceType": "github",
            "skills": {
                "composition-patterns": {
                    "computedHash": "bf90d0a4b83ea054653350f9c67f6de235d3a368"
                },
                "deploy-to-vercel": {
                    "computedHash": "9e25c105ccd1c52691a1e402708bbb216ac78209"
                }
            }
        },
        "anthropics/skills": {
            "sourceType": "github",
            "skills": {
                "algorithmic-art": {
                    "computedHash": "22db2d12091c56340987a877047435ba84a1cdb2"
                }
            }
        }
    }

[SagorIslamOfficial]

Instead of adding new repositories key can you just not reuse the skills key with different way or maybe deprecate it and arrange in new format also why do we need hash in this case ? we just need the source ? we can just update the skill form source no need to check it right ?

"repositories": {
        "SagorIslamOfficial/agent-skills": {
            "sourceType": "github",
            "skills": {
                "composition-patterns": {
                    "computedHash": "bf90d0a4b83ea054653350f9c67f6de235d3a368"
                },
                "deploy-to-vercel": {
                    "computedHash": "9e25c105ccd1c52691a1e402708bbb216ac78209"
                }
            }
        },
        "anthropics/skills": {
            "sourceType": "github",
            "skills": {
                "algorithmic-art": {
                    "computedHash": "22db2d12091c56340987a877047435ba84a1cdb2"
                }
            }
        }
    }

Hi, I’ve made the updates based on your instructions. When you have a moment, please review and let me know if there’s anything else I can do.