feat: safely retire excluded skill aliases

[leojkwan]

What changed

Skillbox sources can now declare exclude = ["legacy-alias"]. Excluded leaves stop resolving, cannot be added, and stay absent after a future sync.

skillbox retire <name> --source <id> safely parks existing runtime links only when they still point at the selected archived source leaf. It refuses a foreign link, a real file, or a lower-priority active source that would otherwise take the name over.

Retirement is capture-first: it uses the platform no-replace rename primitive, anchors the runtime root and recovery journal with directory FDs, and refuses to print a recovery path if either named directory changes mid-operation. Normal Skillbox mutations take one cooperative lock before loading the manifest, so a stale sync cannot remount a just-retired alias.

Why

We need to retire product-specific compatibility aliases without deleting their archived source folders or letting skillbox sync bring them back across Cursor, Codex, and Claude.

Validation

• bash tests/run_all.sh — 19 hermetic test files green
• Python 3.11 and current Python unit suites green locally
• CI green on Ubuntu 3.11 / 3.12 and macOS 3.12; CodeQL green
• Race regressions cover foreign links, occupied recovery destinations, source replacement, recovery-journal replacement, runtime-root replacement, relative links, and stale-sync prevention
• git diff --check

[cursor]

Approved. Cursor Bugbot was not running after the first check poll, and no approval policy or remaining signal required human review. No reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}