fix(install): make install self-sufficient + npx skills add from $HOME

Two root causes found via the install log (install-20260623-181416.log):

A. install.sh runs link.sh BEFORE install-plugins.sh, and install-plugins
   never re-linked, so npx/external skill symlinks were missing on a fresh
   run. Add a final Step 10 that re-runs link.sh (idempotent), so
   `make plugin`/`make install` finish with nothing left to link by hand.

B. `npx skills add` resolves its target (.agents/skills, skills-lock.json)
   relative to the CWD. Run from the repo (which carries gitignored .agents/
   and .claude/), skills landed in $REPO/.agents/skills instead of
   $HOME/.agents/skills where link.sh looks — self-reinforcing once
   $REPO/.agents exists. Run `skills add` from $HOME in both install and
   update paths, and clean the stray repo-local skills dirs (gitignored,
   safe to rm).

Refs LRN-042.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0169vjUD1sP9Nx4ZiCa8wvAw

update-all.sh

@@ -287,10 +287,13 @@ if command -v npx &>/dev/null; then
     fi
     # `skills add` is idempotent and pulls latest from the source repo,
     # which is the closest thing to an update operation the CLI exposes.
-    if npx -y skills add "$_src" 2>/dev/null; then
+    # Run from $HOME: the CLI resolves .agents/skills/ relative to the CWD, so
+    # running from the repo would write into $REPO/.agents/skills (gitignored)
+    # instead of $HOME/.agents/skills where link.sh expects it.
+    if (cd "$HOME" && npx -y skills add "$_src" 2>/dev/null); then
       ok "$_name refreshed from $_src"
     else
-      warn "$_name refresh failed — run manually: npx -y skills add $_src"
+      warn "$_name refresh failed — run manually: (cd \"\$HOME\" && npx -y skills add $_src)"
     fi
   done
 else