fix(impeccable): global-scope install with agents, pin fallback, output-read failure check

make plugin never installed impeccable. The 3.2.0 pin had rotted upstream
(the CLI fetches its skill dist at install time; that release's zip is
gone), the --scope=project staging moved the skill dir alone and dropped
the 4 impeccable-* subagents, and /impeccable init was never announced.

Step 8d now installs at --scope=global straight through the
~/.claude/{skills,agents} symlinks into the repo (both paths gitignored),
guards on those symlinks existing, keeps a profile-parked copy parked,
falls back to @latest on a pin failure with a bump-the-lock warning, and
prints the per-project init hint. update-all.sh mirrors the shape.

Found while probing: with a copy already installed a rotted pin exits 0
("Could not check for skill updates ... left unchanged"), byte-identical
on disk to an up-to-date rerun, so imp_install reads the installer output
instead of trusting the exit code. Harness 4/4 in a sandbox HOME with the
real installer.

plugins.lock.json: impeccable 3.2.0 -> 4.1.0 (CLI only). link.sh drops
impeccable from EXTERNAL_SKILLS. lib/design-gate.md section 5: suggest-only
/impeccable init check when a frontend project has no PRODUCT.md.

.gitignore

@@ -64,8 +64,16 @@ skills/ios-sync
 skills/design-motion-principles
 skills/emil-design-eng
 skills/frontend-design
+
+# Impeccable — NOT a symlink: `impeccable skills install --scope=global`
+# writes the skill dir (and its ~15 MB engine binary) straight in through the
+# ~/.claude/skills symlink. Machine-owned, regenerated by make plugin/update.
 skills/impeccable
 
+# …and the 4 subagents the same installer drops through ~/.claude/agents.
+# agents/ is a tracked directory, so these need naming explicitly.
+agents/impeccable-*.md
+
 # External skills installed via `npx skills add` — auto-created by link.sh
 skills/darwin-skill
 
@@ -169,12 +177,6 @@ skills-external/emil-design-eng/
 # layout and the content is sha256-verified against 21st.dev's manifest.
 skills-external/21st-*/
 
-# Impeccable — machine-owned dist produced by `npx impeccable skills install`
-# (install-plugins.sh Step 8d, update-all.sh), pinned in plugins.lock.json.
-# Not vendored: the installer owns the layout and rewrites it on update
-# (ctx7 pattern). Symlinked into skills/ by link.sh.
-skills-external/impeccable/
-
 # npx `skills add` project-scope artifacts — darwin-skill copies itself into
 # the repo's .agents/ and writes skills-lock.json at root. Our own agents live
 # in agents/ (no dot) and stay tracked. Anchored to root so only the dotted