feat: add skills lock management and commands for updating/removing skills

[SagorIslamOfficial]

Issue: #701

This PR introduces a skills lock and update system, inspired by Vercel's Skills CLI. When you install skills using boost:add-skill, the system now tracks each skill's source, version, and hash in a boost-skills-lock.json file in the root folder, enabling you to update installed skills when new versions are available on GitHub.

Usage

Skills Lock File (boost-skills-lock.json) - Tracks installed skills with:

• Install skills: php artisan boost:add-skill
• Update installed skills: php artisan boost:update-skills
• Re-sync local drifted skill files: php artisan boost:update-skills --sync
• Trigger skills update through boost:update: php artisan boost:update --update-skills
• Remove skills interactively: php artisan boost:remove-skill

Note: you can also use --force

boost-skills-lock.json file:

{
    "version": 1,
    "repositories": {
        "SagorIslamOfficial/agent-skills": {
            "sourceType": "github",
            "skills": {
                "composition-patterns": {
                    "computedHash": "bf90d0a4b83ea054653350f9c67f6de235d3a368"
                },
                "deploy-to-vercel": {
                    "computedHash": "aa82a6f7819a2a7691a39be2a968aab0d6e344e0"
                }
            }
        },
        "anthropics/skills": {
            "sourceType": "github",
            "skills": {
                "brand-guidelines": {
                    "computedHash": "7dc45f289fa37f9763a993008d9500e9a157fa4a"
                },
                "claude-api": {
                    "computedHash": "5a67769c8d12b9eb00c840ccc9e74a37d9d2a3c9"
                }
            }
        }
    }
}

Note: I tested all newly added features and found no breaking changes after the implementation.

[github-actions]

Thanks for submitting a PR!

Note that draft PRs are not reviewed. If you would like a review, please mark your pull request as ready for review in the GitHub user interface.

Pull requests that are abandoned in draft may be closed due to inactivity.

[pushpak1300]

• adding new lock file is not a correct approach here we should combine this in boost.json
• also keep scope of the Mr as low as possible and tackle different features in different pr one after another.
• for now start with a simple solution. if user add any skill using add skill then track it in boost.json
• update-skills should fetch and repalce from the source.

[SagorIslamOfficial]

I'm following your instructions and created a new PR with initial features. Please check this PR #760