[FEATURE] apm find — trace a file back to the package that brought it

[vlsi]

Is your feature request related to a problem? Please describe.

When inspecting a deployed APM workspace, I often need to know which package contributed a given file, so I can decide where to edit/update it.

Today, when a user or agent wants to update a skill / command / instruction, there's no straightforward way to find which package owns it. Users end up grepping the whole dependency tree by hand. A first-class provenance command makes "edit the right source" a one-liner and unblocks agents that need to make upstream-aware edits.

Describe the solution you'd like

apm find .claude/commands/troubleshooting-triage.md

→ should report the package name (and ideally the dependency path) that brought this command in.

Describe alternatives you've considered

I considered analyzing apm_modules contents, however, it looks more like a workaround.

Files to support

Provenance lookup should work for any file APM materializes:

• skills (.claude/skills/...)
• commands (.claude/commands/...)
• agents (.claude/agents/...)
• hooks (.claude/hooks/..., settings entries)
• AGENTS.md / CLAUDE.md (multi-source — see below)

Detail levels

The command should expose progressive verbosity:

1. Default — just the package name(s):

   acme/triage-tools
   

2. --source — package + origin it was resolved from (OCI registry URL, git ref, local path):

   acme/triage-tools  (oci://ghcr.io/acme/triage-tools:1.4.2)
   

3. --path — full dependency chain showing how the package entered the closure:

   root → acme/team-bundle@2.1.0 → acme/triage-tools@1.4.2
     source: oci://ghcr.io/acme/triage-tools:1.4.2
   

For local dependencies, the source should be the filesystem path (e.g. ../packages/triage-tools).

Multi-contributor files

AGENTS.md and CLAUDE.md are typically assembled from multiple packages. apm find should list all contributing packages, ideally with the section/range each one contributed:

apm find AGENTS.md
acme/team-bundle      lines 1–24
acme/triage-tools     lines 25–60
<workspace>           lines 61–end

Out of scope (for now)

• Reverse lookup across remote registries (only resolved/installed deps).
• Diffing across versions — purely "who put this here".