feat(claude-code): manage the user's global config in the Module

Bring the declarative half of ~/.claude into modules/claude-code and apply
it when the Module is enabled: the global agent instructions (context =
./CLAUDE.md), the skills tree (skills = ./skills), the attention-bell hook,
and settings.json (model = opus plus the Stop/Notification/SessionStart
hook wiring).

Runtime state (projects, plugins, cache, history, sessions) and the
.credentials.json secret are left out, so login survives rebuilds and no
secret enters the repo. Verified against the built home-files that
~/.claude/{CLAUDE.md,settings.json,skills,hooks/attention-bell.sh} are
generated, the hook executable.

modules/claude-code/skills/update-skills/SKILL.md

@@ -0,0 +1,52 @@
+---
+name: update-skills
+description: Check the current project's installed library skills for upstream changes and apply the safe ones.
+disable-model-invocation: true
+---
+
+Compares every skill listed in the current project's
+`.claude/skills-lock.yaml` (see [LOCKFILE.md](../setup-skills/LOCKFILE.md)
+for its schema) against both the project's own copy and the current
+library source, and decides what to do about each one. Never installs a
+skill that isn't already there — that's
+[`setup-skills`](../setup-skills/SKILL.md)'s job.
+
+## Steps
+
+1. Read `.claude/skills-lock.yaml`. If it doesn't exist or is empty, tell
+   the user there's nothing to check and stop.
+
+2. For each `{name, hash}` entry, compute:
+   - `project_hash`: `~/.claude/skills/setup-skills/hash-dir.sh .claude/skills/<name>`
+   - `library_hash`: `~/.claude/skills/setup-skills/hash-dir.sh ~/.claude/skills/library/<name>`
+
+   If either path is missing entirely, report that anomaly for this skill
+   (don't try to classify it) and move on to the next entry.
+
+3. Classify each entry against the table in
+   [LOCKFILE.md](../setup-skills/LOCKFILE.md#what-a-mismatch-means),
+   using `project_hash` in place of "project copy" and `library_hash` in
+   place of "library source". The two outcomes that need action below are
+   **safe update** (stored matches project, differs from library) and
+   **conflict** (stored differs from both). "Locally customized" needs no
+   message beyond the summary.
+
+4. If there are any safe updates, list them by name and ask for one
+   confirmation to apply all of them — unless the user's invocation
+   already included an explicit go-ahead argument (e.g. `-y`, `yes`), in
+   which case apply them without asking. Applying means: delete
+   `.claude/skills/<name>/` entirely and copy
+   `~/.claude/skills/library/<name>/` in its place, so no file the project
+   copy had but the library no longer has can survive — then recompute its
+   hash and overwrite that entry's `hash` in `.claude/skills-lock.yaml` in
+   place.
+
+5. For every conflict, report it and show a recursive diff between the
+   project's copy and the library's current version
+   (`diff -ru .claude/skills/<name> ~/.claude/skills/library/<name>`).
+   Do not modify the project's copy or the lockfile entry for a
+   conflicted skill under any circumstances — surfacing it is the whole
+   job here.
+
+6. Finish with a summary: updated, left alone (customized), conflicted,
+   already current, and any anomalies from step 2.