feat(mcp): implement the advertised in-place update (--update is a no-op today)

[stuffbucket]

Problem

The update-skills skill tells users to run npx -y github:stuffbucket/skills --update to apply an update (plugins/stuffbucket/skills/update-skills/SKILL.md:22; also printed by plugins/stuffbucket/skills/update-skills/scripts/version-check.js:109). No --update flag is handled anywhere:

• mcp-server.js treats process.argv[2] only as a root-directory path (:31-37).
• cli.js handles only list / get / version / help (:155-177) — there is no update case.

So the advertised command silently no-ops / mis-parses. Separately, getUpdateInstructions() (plugins/stuffbucket/skills/skill-router/scripts/version-check.js:116-140) only prints manual git fetch --tags + git checkout vX steps, which do not apply to an npm/npx install (no .git).

Proposed

Decide and implement the in-place upgrade model, per install type:

• Implement a real --update (in cli.js and/or the bin entry) that performs a distribution-correct in-place upgrade:
  • npm/npx install: refresh the npx cache entry for @stuffbucket/skills and/or run npm install -g @stuffbucket/skills@latest when globally installed, then verify the new version.
  • git / plugin install: detect .git and do the correct git fetch --tags && git checkout vX path.
• Detect the install type and choose the right path automatically rather than assuming git.
• Make the advertised instructions in update-skills/SKILL.md and both version-check.js files match what is actually implemented — no dangling --update.

Note: maximal is deliberately notify-only (no auto-install); a valid outcome here is either a managed in-place upgrade or notify-only with instructions that actually work for each install type. Pick one and make the docs match.

Acceptance criteria

• The advertised command (or its corrected replacement) actually upgrades the installed package/skills in place, per install type.
• After updating, the running version matches latest and update detection clears.
• No advertised command that is silently a no-op.

References

• Advertised but unimplemented: plugins/stuffbucket/skills/update-skills/SKILL.md:22, plugins/stuffbucket/skills/update-skills/scripts/version-check.js:109, plugins/stuffbucket/skills/skill-router/scripts/version-check.js:116-140
• Arg handling: plugins/stuffbucket/skills/skill-router/scripts/mcp-server.js:31-37, plugins/stuffbucket/skills/skill-router/scripts/cli.js:155-177
• Reference model: maximal notify-only self-update (docs/spec/phase-6-self-update.md)

[stuffbucket]

Tracked in #30.