docs(skills): preserve npm/nuget version ranges in upgrades (#175)

Author: brianhdk

.agents/skills/upgrade-dependencies/SKILL.md

@@ -67,6 +67,14 @@ Create and switch:
 git switch -c $branchName
 ```
 
+## Version Range Preservation Rules
+Preserve existing version-range declarations when upgrading dependencies.
+
+- npm: If the current declaration uses comparator-range syntax (for example `>=1.1.6 <2.0.0`), keep it unchanged and do not rewrite it to caret/tilde/exact forms.
+- Skip upgrade commands for dependencies already declared as ranges under the rules above.
+- You may still report recommended minimum-version bumps when vulnerabilities or critical fixes are identified.
+
+
 ## Discover npm Manifests
 Discover package manifests under `packages/`, excluding `node_modules`.
 
@@ -122,6 +130,11 @@ Notes:
 - Keep lockfile updates generated by npm commands.
 - Ignore nested lockfiles that do not have a sibling `package.json`.
 
+Before running `npm install "$pkg@latest"` for each package, inspect the current declaration in `dependencies` or `devDependencies`:
+- If the current declaration uses comparator-range syntax (for example `>=1.1.6 <2.0.0`), skip that package and keep the declaration unchanged.
+- Do not rewrite comparator ranges to caret, tilde, or exact-version declarations.
+- Record skipped ranged npm packages and any recommended minimum-version bumps in both PR summary and final output.
+
 ## Resolve Upgrade Fallout
 Fix compatibility issues directly caused by dependency upgrades:
 - API or signature changes
@@ -194,6 +207,7 @@ __TRELLO_CARD_URL__
 
 ## Summary
 - <short summary of upgraded dependencies and compatibility fixes>
+- <skipped ranged dependencies kept unchanged, plus recommended minimum-version bumps (if any)>
 
 ## Validation
 - `packages/client`: <build/test result or not touched>
@@ -230,5 +244,6 @@ Provide a final summary with:
 - upgraded npm packages grouped by manifest path
 - compatibility fixes applied
 - results for each validation command
+- skipped ranged dependencies kept unchanged, with recommended minimum-version bumps when applicable.
 - pushed branch URL
 - PR URL, or exact manual fallback instructions when automated PR creation is unavailable