fix(cli): prevent stale embedded skills manifest drift

[pentaxis93]

Summary

• make groundwork init/groundwork update attempt a runtime fetch of skills/skills.toml from GitHub
• fall back to the embedded manifest with explicit warnings when fetch/parse/validation fails
• add groundwork doctor manifest freshness reporting for embedded-vs-repo drift

Changes

• add manifest-loading helpers for runtime fetch, embedded fallback, and parse/validation flow
• add doctor freshness check with SHA-256 comparison and skipped-check info output
• add unit tests for runtime success, fallback on failure, and freshness states (matching/stale/skipped)
• update changelog with the new CLI freshness behavior

Issue(s)

Closes #112

Test plan

• cargo fmt --all
• cargo test -p groundwork-cli

[github-actions]

I did not find any blocking correctness or reliability regressions in the diff against origin/main. The new runtime-manifest fetch path includes explicit fallback behavior and tests for the primary failure modes.

Raw outputs: codex-review.md, codex-review.jsonl

[github-actions]

[P2] Preserve fetched manifest bytes for freshness hashing

fetch_remote_manifest_text uses run_command_capture, which trims stdout before returning it. That strips trailing newlines from skills.toml, so check_embedded_manifest_freshness_with hashes different bytes than SHIPPED_SKILLS_TOML even when the remote file is identical (the current manifest ends with a newline). In that case groundwork doctor will incorrectly report the embedded manifest as stale.

[pentaxis93]

Addressed the freshness-hash false-positive concern in aa09aa4.

Changes:

• switched remote manifest fetch to raw stdout capture (no .trim()), preserving trailing newline bytes for hashing
• kept existing trimmed capture helper for other call sites
• added regression test raw_command_capture_preserves_trailing_newline

Verification run:

• cargo fmt --all
• cargo test -p groundwork-cli