fix: root-level skill update breaks directory structure and fails backfill

[crossoverJie]

Problem

When updating a root-level skill (SKILL.md directly in the repo root, e.g. eze-is/web-access), two bugs occur:

1. Directory becomes a file: updateSkill() derives folderPath = "SKILL.md" instead of "", so copyItem copies the SKILL.md file over the skill directory, breaking the symlink. Claude Code can no longer find the skill.

2. Update detection fails: checkForUpdate() and checkAllUpdates() use the same buggy folderPath derivation, causing getTreeHash to compute git rev-parse HEAD:SKILL.md (blob hash) instead of git rev-parse HEAD: (root tree hash). Hash comparison produces incorrect results.

3. Backfill crashes: findCommitForTreeHash with empty folderPath runs git log --format=%H -- "", which git rejects as an invalid empty pathspec.

Root Cause

The lock file stores skillPath = "SKILL.md" for root-level skills. The inline folderPath derivation logic checked hasSuffix("/SKILL.md") — "SKILL.md" does not end with "/SKILL.md", so it fell through to folderPath = lockEntry.skillPath (= "SKILL.md"), instead of being treated as an empty path.

Fix

• Extracted deriveFolderPath(from:) static helper in SkillManager — handles "SKILL.md" → "" explicitly, eliminating duplicated logic across checkForUpdate(), checkAllUpdates(), and updateSkill()
• Fixed findCommitForTreeHash in GitService — when folderPath is empty, omits the -- separator to avoid the empty pathspec error
• Added 10 unit tests in RootLevelSkillUpdateTests.swift covering derivation logic, hash behavior, directory preservation, and backfill regression

Manual Verification Required

• Install a root-level skill (e.g. eze-is/web-access) via SkillDeck, verify it appears in Claude Code
• Trigger an update for a root-level skill, verify the directory structure is preserved (not flattened to a file)
• Verify sub-directory skills (e.g. from vercel-labs/skills) still update correctly — no regression

Regression Checklist

• Sub-directory skill install/update still works (e.g. find-skills, systematic-debugging)
• Update detection (checkmark badges) still shows correct status for GitHub-backed skills
• Batch "Check All Updates" still works for mixed root-level and sub-directory skills
• Local import skills are unaffected (no lock entry with sourceType: "github")
• ClawHub-installed skills are unaffected