fix(installer): fix agent detection, global install, and add interactive agent selection

[derek-palmer]

Summary

• Fix shellEscape missing closing quote — all command:-based agent detections (claude, gemini, opencode, codex, …) silently returned not found because sh -c "command -v 'claude" is a syntax error; only agents with a macapp: fallback (Cursor) were detected
• Fix global install not being global — installViaSkills never passed -g to npx skills add, so global and local modes both installed project-local
• Fix --all overriding agent profile filter — replaced --all shorthand with explicit --agent <profile> --skill '*' so the per-provider profile is respected
• Fix fetchSkill ignoring bundled skills — when run via npx, detectRepoRoot() returned null (no plugins/ in the npm package) so skills were always fetched over HTTPS even though skills/ ships in the package; now falls back to __dirname/../skills/ before hitting the network
• Add interactive agent selection — when multiple agents are detected and stdin/stdout are TTYs, the installer now prompts users to choose which agents to install to (numbered list, space-separated selection, default: all); skipped by --only, --non-interactive, or single-agent scenarios
• Update README and --help — document --non-interactive, the two-prompt flow, and --only skipping agent selection

Test plan

• shellEscape unit tests: plain strings, embedded quotes, shell round-trip via printf, command -v detection
• Global dry-run: --agent <profile> --skill '*' -g appear; --all absent
• Local dry-run: no -g, paths target cwd .claude/skills/ and .agents/skills/
• --only <unknown> exits non-zero with "unknown agent" error
• --non-interactive --local exits 0 without hanging

All 22 tests pass (npm test).

🤖 Generated with Claude Code