fix(update): honor locked paths with mirrored skills

[yuzhang-zhong]

Summary

Fix skills update skipping a skill when its locked path still exists but the upstream repository also contains same-name mirrors.

• Let the existing skillPath disambiguate only when the source installer can target that exact subpath.
• Keep the current fail-closed behavior for generic Git sources, which reinstall from the whole repository by skill name and therefore cannot safely choose between duplicates.
• Cover both project and global GitHub updates, including the clone fallback used when the GitHub tree API is unavailable.

This is intentionally narrower than simply moving the exact-path check before the ambiguity check: that unconditional change could reinstall the wrong copy for generic Git sources.

Tests

• npx -y node@22.20.0 node_modules/vitest/vitest.mjs src/skill-relocation.test.ts tests/update.test.ts --run — 36 passed
• pnpm type-check — passed
• Prettier check for all four changed files — passed
• Build with temporary Node 22.20 — passed
• Full suite with temporary Node 22.20 — 823 passed, 7 environment/baseline failures: five Windows symlink-permission cases, one unrelated mock missing GitCloneError, and dist.test.ts invoking the machine's Node 22.15 instead of the required Node >=22.20

Fixes #2227
Fixes vercel/ai#22399

AI assistance disclosure

This contribution was developed with Codex assistance, including repository analysis, implementation, tests, and PR drafting, under Yuzhang Zhong's direction.

[agoticobran]

Independently reviewed commit 3e7fa9b with Codex assistance. Reproduced the locked-path ambiguity in the base resolver and verified that this change resolves it for path-addressable sources. Also checked that generic Git sources and missing locked paths with multiple candidates remain blocked.

On macOS with Node 22.22.3, all 64 tests across skill-relocation, update, and update-source passed, as did type-checking, the build, and formatting checks on the changed files. I did not run the full suite or a live installed-skill update. No actionable findings in this scoped review.