feat: implement extends resolution, --force update, and parent merge in export

[tianhaocui]

What

Implement extends resolution in install, add --force flag for updates, and merge parent agent content in export --format claude-code.

Why

The spec (Section 15: Inheritance) defines extends with clear merge rules, but the implementation was completely missing:

• extends field is parsed but never acted on — install only handles dependencies
• install skips if target exists — no way to update without manual rm -rf
• export only reads current directory — ignores installed parent agent
• Git source detection hardcoded to github.com — Bitbucket/GitLab repos fail

This means the core cross-project sharing workflow described in the README doesn't work.

Closes #53

How Tested

• npm run build passes
• gitagent validate passes on example agents
• Manual testing (describe below)

Tested with:

• Bitbucket private repo via SSH (git@bitbucket.org:org/shared-agent.git)
• extends in child agent.yaml → gitagent install clones to .gitagent/parent/
• gitagent install --force removes and re-clones
• gitagent export --format claude-code -o CLAUDE.md merges parent SOUL.md, RULES.md, and skills/
• Child SOUL.md replaces parent, child RULES.md appends to parent, child skills shadow parent

Checklist

• My code follows the existing style of this project
• I have added/updated tests (if applicable)
• I have updated documentation (if applicable)
• I have read the CONTRIBUTING.md

[shreyas-lyzr]

Reviewed and merged with fixes.

What was good:

• extends resolution is a meaningful feature — the spec defined it but it was never implemented
• Merge rules are correct per spec Section 15 (child SOUL replaces parent, child RULES appends, skills union with child shadowing)
• --force flag is useful for updates
• isGitSource() supporting GitHub, Bitbucket, and GitLab is a good broadening

Fixes applied before merge:

1. Command injection — cloneGitRepo used execSync with string interpolation (\git clone ... "${source}"`). Replaced with execFileSync('git', [...args])` per the security fix in PR fix: replace execSync string interpolation with execFileSync to prevent command injection #48.
2. Shell cp -r calls — Two execSync(\cp -r ...`)calls replaced withcpSync()` (same fix pattern as PR fix: replace execSync string interpolation with execFileSync to prevent command injection #48).
3. export.ts / import.ts skipped — These changes overlapped with the already-merged PR fix(issue,53): fixed duplicated required options in export and import #60 fix. Only install.ts and claude-code.ts were taken from this PR.

Note for future work:

• Parent merge only applies to claude-code export. Other adapters (system-prompt, cursor, opencode, etc.) don't resolve extends. This should be generalized — probably at the loader level rather than per-adapter.
• No tests included. Would be good to add tests for extends resolution.

Thanks @tianhaocui!

[shreyas-lyzr]

Apologies for the slow review — this PR predates a busy stretch on my side and I should have engaged sooner.

The good news: extends-resolution, the --force re-install flag, and mergeParentContent (SOUL replace, RULES union, skills/tools child-shadow) are all in main now (see src/commands/install.ts:42-97 and src/adapters/claude-code.ts:15 mergeParentContent). They were merged with security hardening — execFileSync instead of execSync with shell interpolation, and cpSync instead of cp -r — to close a command-injection vector.

Closing this as superseded. Thank you for putting the original design forward; the version that landed is materially yours, with security adjustments. Real appreciation for the patience.

[shreyas-lyzr]

Superseded by main (see comment above).