fix(lock): reject unreadable resolved files before writing - #12

Summary

An existing skills.resolved that could not be decoded was treated as empty state. The next successful add overwrote it and lost every previous pin, and read commands hid the problem (skill list printed "No project skills found" and exited 0).

Now:

• Loading an existing resolved file that cannot be decoded (invalid JSON, wrong schema, version below 1) throws Invalid state: resolved file <path> could not be decoded. The file is never replaced. Legacy-schema content at the current path still decodes; when the current file exists the legacy file is not read.
• Every mutating path validates the selected scope's resolved state before changing installed files, the resolved file or the watch ledger: add (including --watch and --watch-only), install, update --apply, update --from-watch --apply and remove.
• skill list and skill list --all exit non-zero with the decode error. skill doctor reports resolved-file as error with ok: false and a repair hint.
• A source's own .agent/skills.resolved, which discovery uses only to skip installed copies inside the source, is a hint: if it cannot be decoded, discovery ignores it, so skill add <source> and skill list <source> keep working for third-party repositories.

Validation

• swift build — pass
• swift test — 127 tests in 17 suites pass
• xcrun swift-format lint --configuration .swift-format --recursive Package.swift Sources Tests — exit 0, no new warnings in changed files
• git diff --check — clean
• Manual checks with an isolated HOME: with a corrupted project resolved file, list, add, add . --watch-only, remove, install and update --apply fail, nothing is installed or removed, no watch ledger is created and the file stays byte-identical; with valid project state, add/list from a source whose own resolved file is corrupted succeed.

Resolves #5