SP-1297: Add download agent skill bundle command

[Thomas Neumüller (tneum-celonis)]

Description

Adds content-cli asset-registry skills download --path <path> [--output <parentDir>], which installs a complete agent skill bundle (SKILL.md + all reference files) to the local filesystem in one command, preserving folder structure and overwriting existing files.

Builds on SP-348's single-file skills get: a new listSkillFiles API call to GET /pacman/api/core/asset-registry/skills/{path}/files fetches the manifest, then each entry is downloaded via the existing getSkillFile and written under <output>/<skillName>/<relativePath>. Includes a path-traversal guard so malformed manifest entries cannot escape the target directory. FileService.writeBufferToPath now mkdirs the file's parent (backwards-compatible for the existing basename-only callers).

Relevant links

• Jira: https://celonis.atlassian.net/browse/SP-1297

Checklist

• I have self-reviewed this PR
• I have tested the change and proved that it works in different scenarios
• I have updated docs if needed

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
94.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Buqeta (Buqeta)]

We already have content-cli asset-registry skills get --path {path of the skill} --file {specific file}. Adding content-cli asset-registry skills download seems confusing, since we can just change the behavior of asset-registry skills get to download the whole bundle when the --file option is ommitted.

cc: Zgjim Haziri (@ZgjimHaziri) Kastriot Salihu (@ksalihu) Would appreciate your opinions here too.