hyperframes CLI: skills removed-detection power-user follow-ups (from #1740)

[jrusso1020]

Non-blocking power-user follow-ups deferred from the review of #1740 (merged at 88fffb04). All four were flagged by reviewers (Rames D Jusso + Miga) during review and explicitly agreed as non-blocking — tracked here rather than holding the merge.

1. --dir users skip removed-detection

skillsManifest.ts:222-225 — locateInstall hardcodes scope: "project" for any --dir, so lockPathForScope reads ./skills-lock.json (absent for a typical --dir ~/.claude/skills), readSkillLock falls through to catch → null, and detectRemoved returns zero. The power-user --dir path silently never detects removed skills.

2. update is asymmetric with check on --source / --dir

skills.ts:181-225 — check plumbs --source / --dir through; update has args: {}, so the internal checkSkills() in update's prune step (~:212) hits defaults. A user testing against a fork sees different removed-sets between the two commands. Either add symmetry or document as a known divergence.

3. Lock-path version pinning is implicit

skillsManifest.ts:336 — comment says "mirroring that CLI's paths" but there is no version pin to vercel-labs/skills. If they move the lock file, detectRemoved silently no-ops.

4. All-rejected-names early-return path uncovered by tests

skills.ts:71 — test-only gap; cheap to add.

---

Context: #1740 added skills-removed-detection + prune. The load-bearing review feedback (the -g global-scope test, the latent cross-scope-delete guard, and the strict kebab-case name validator against flag-injection) all shipped before merge. These four are the deferred edges.

— Jerrai

[jrusso1020]

Closing — tracking these as a follow-up PR per maintainer preference, not a repo issue.