feat: add setup skill/hooks and update shadow (task 0018)

Distribute gitea-axi's ambient context via explicit user actions (ADRs
0009, 0013), with no postinstall script:

- Bundle the Agent Skill markdown at skills/gitea-axi/SKILL.md (a
  minimal pointer, not a command reference) and ship it via package.json
  files.
- Add `setup`, which installs the skill into ~/.claude/skills/
  idempotently (installed/updated/unchanged).
- Add `setup hooks`, which registers a SessionStart hook running the
  bare dashboard for Claude Code, Codex, and OpenCode via the SDK's
  installSessionStartHooks(), updating managed entries in place.
- Shadow the SDK's built-in `update` so it fails with VALIDATION_ERROR
  and points at the npm update command, keeping the ten-code error list
  intact.

Integration tests drive all three at the CLI seam against a temporary
HOME; these commands make no Gitea API calls, so there is no live-Gitea
e2e case.

src/cli.ts

@@ -5,6 +5,8 @@ import { issueCommand } from "./commands/issue.js";
 import { labelCommand } from "./commands/label.js";
 import { prCommand } from "./commands/pr.js";
 import { searchCommand } from "./commands/search.js";
+import { setupCommand } from "./commands/setup.js";
+import { updateCommand } from "./commands/update.js";
 import type { CliDeps, GlobalFlags } from "./deps.js";
 import { consumeFlagValue, splitFlag } from "./flags.js";
 import { renderErrorOutput } from "./render.js";
@@ -28,6 +30,7 @@ commands:
   label create     Create a label
   search issues    Full-text search for issues in the current repository
   search prs       Full-text search for pull requests in the current repository
+  setup            Install the bundled Agent Skill (setup hooks adds the session-start hook)
 
 global flags:
   -R, --repo <OWNER/NAME>   Override the repository detected from the git origin remote
@@ -119,6 +122,9 @@ export async function runCli(options: RunCliOptions): Promise<number> {
       pr: prCommand(deps),
       label: labelCommand(deps),
       search: searchCommand(deps),
+      setup: setupCommand(deps),
+      // Shadow the SDK's built-in `update` self-update command (ADR 0013).
+      update: updateCommand(deps),
     },
     home: dashboardCommand(deps, full),
     stdout: options.stdout,