Correct the migration skill's refresh order and its update invocation

[nilbot]

Found by running the skill from #41 against cowork on v0.5.0. Neither defect is reachable by reading it.

The self-refresh deadlocked

Step 0 refreshed a stale skill; Step 2 required a clean working tree. The refresh writes a tracked file, so following the steps in order produced a tree the next step rejected. Detection is now Step 0 and read-only; the fix is Step 3.5, after branch isolation, where the refreshed skill belongs in the migration commit.

The invocation did not exist

The skill, the doctor remedy, and the original design's §6 check table all said agents update --apply. The CLI answers:

agents update: --all is required; use `agents wire` for one repository

RefreshInfrastructuralSkills is reachable from exactly one call site, the --all path in cmd_fleet.go:150, and agents wire does not refresh skills — so there is no single-repository form, and the refresh necessarily rewrites the skill in every registered repository. The skill now says so and tells the reader how to handle the other repos.

The gates

TestLivingDocumentsSpellUpdateWithAll closes a real gap. Neither existing check could see this one: update exists and --apply is a registered flag — what is wrong is an absent required flag, which no existence check detects. A bare agents update is prose naming the command and passes; a flag-bearing span without --all fails.

Two things worth flagging about it:

• Its first version could not fail. The control passed with the invalid command reintroduced, because the regex scanned inline backtick spans while the real command sits in a ```bash fence — the one place a reader copies from. It now scans both, verified against a fenced and an inline sabotage.
• The bug was in the gate too. TestMigrationSkillCoversItsSpecifiedProtocol asserted the skill contains agents update --apply — it required the invalid command, having been written from the same spec as the skill. A green suite proved only that the two agreed.

Amendment 1a records both defects in the design.