fix(skill): verify staged symlink identity

[pablontiv]

What

Fix rootline skill install when the Agents/Pi preimage is a symlink to the Claude destination being replaced by the same approved plan.

Related issue

Refs #210

The issue remains open until the real-home migration is retried with a complete receipt and runtime discovery is verified.

Why

The first post-merge operational run exposed a false staged preimage evidence changed failure. Install replaced Claude first; the existing Agents symlink still had the exact same lexical target, but its dereferenced digest changed because Claude now resolved to the canonical source. The operation incorrectly treated its own prior action as external preimage drift.

The failed operation remained fail-closed and preserved an incomplete receipt plus verified backup evidence.

How

• Add a real-filesystem regression reproducing Claude directory + Agents→Claude symlink.
• Verify staged symlink preimages by the identity of the restorable object: destination ID, kind, backup identity, and exact lexical target.
• Keep full digest/canonical evidence checks unchanged for directories and other states.
• Record the security boundary in accepted ADR 0008 and document the fix in CHANGELOG.

Verification

• RED: TestInstallConvergesWhenAgentsPreimageTargetsClaudeDestination failed with staged preimage evidence changed before the fix.
• GREEN: focused regression passes.
• go test ./internal/skilldist -race -count=1
• skill-focused CLI/E2E race tests
• just test
• just check
• just coverage-check — total 89.9%, internal/skilldist 85.4%
• ADR validation — 8 valid, 0 invalid
• independent review — ready to merge, no findings

Checklist

• Tests pass (go test ./... -race)
• Code is clean (go vet ./... via project checks)
• Changes are documented if user-facing
• Deliberately linked with Refs #210; closure waits for the completed operational gate