feat: unified source cache for multi-feature install

[wfscot]

Summary

• Extends rulesync install to fetch all features (skills, rules, commands, subagents, mcp, hooks, ignore) from declared sources, not just skills
• Caches fetched content in a unified per-source directory (.rulesync/.sources/<source>/) preserving the rulesync directory structure
• During rulesync generate, all processors read from the source cache with local-first precedence and first-declared-source-wins deduplication
• Single-file features (mcp.json, hooks.json, .aiignore) are deep-merged across sources

Key changes

• Config schema: New features field on source entries to control which feature types are fetched
• Lockfile v2: Per-file integrity tracking (files record) replacing per-skill tracking, with automatic migration from v1
• Source cache: .rulesync/.sources/ replaces .rulesync/skills/.curated/ (backward compat with deprecation warning)
• Merge strategies: mergeMcpServers, mergeHooks, mergeAiignore for single-file features
• All 7 processors updated to load from source cache (skills, rules, commands, subagents, mcp, hooks, ignore)
• Both transports (GitHub API and git CLI) fetch all feature types
• Orphan cleanup: Removing a source from config cleans up its cache directory on next install

Test plan

• pnpm cicheck passes (4361 tests, all lint/type/spell/secret checks)
• Integration tests for multi-feature fetch, MCP merge, and curated backward compat
• Manual test: source with skills + rules + mcp.json cached in .sources/
• Manual test: local rule overrides source rule of same name
• Manual test: removing source from config cleans orphaned cache directory