feat(sdk): add skill lifecycle status - #37

What's changed?

• add cross-SDK bundle build metadata, installed metadata readers, lifecycle status reports, and ownership-safe uninstall behavior
• add Go Cobra status and uninstall commands with structured JSON output and non-interactive confirmation safety
• extend the shared golden matrix to cover metadata refresh, status states, and empty metadata idempotency across all SDKs
• publish the Go core tag before validating and publishing the same-version Cobra adapter tag

Why

• let embedding CLIs inspect and safely manage the bundled skills they own
• keep the Go core and Cobra adapter on one release version without resolving an unpublished same-version dependency during source checks

Verification

• node scripts/check.mjs
• node scripts/prepare-release.mjs patch --dry-run
• simulated v0.1.4 module publication with node scripts/check-go-modules.mjs --published-core
• git diff --cached --check

Closes #33