v0.5.0

What changed

• sync --recommended-skills --enforce now starts by offering cleanup of user-owned manifest sources outside the current recommendations, including old defaults with unknown recommendation ownership.
• Cleanup requires explicit confirmation. Declining preserves those entries and installed skills and skips their installation for that enforced sync, even with --update-skills.
• Show cleanup selections as readable owner/repository/skill lines, or owner/repository for wildcard or unspecified selections, instead of a JSON diff.
• Keep cleanup consent separate from recommendation acceptance, retain manifest backups and conservative ownership checks, and stop before recommendation installation when cleanup fails.
• Fix retirement verification when Skills CLI lists unrelated agent roots despite --agent; preserve unrelated Codex skills without weakening source-specific deletion checks.
• Document the enforcement boundaries, conditional dry-run preview, and recovery behavior in the README, configuration and extension guides, and repository guidance.

Verification

• Behavioral suite on main: 226 tests run, 2 native-Windows-only skips, no failures.
• Local manifest and tracked baseline validation passed; CLI version reports 0.5.0.
• Isolated CLI checks covered cleanup confirmation, declined cleanup, and non-mutating previews.
• A smoke run using the actual Skills CLI verified universal retirement while preserving an unrelated Codex skill; the regression failed before the fix and passed afterward.