fix(install): reject option-like skill names

[itsjling]

What changed

• reject dash-prefixed skill names from discovery output
• reject unsafe names in catalog validation without echoing the raw value
• guard direct install calls before logging or invoking the upstream runner
• keep multiword skill names unchanged
• add regression tests for all three boundaries
• mark Plan 001 done

Why

skills@1.5.22 treats a dash-prefixed value after --skill as an option. A source or hand-edited catalog could therefore alter the install command instead of naming a skill.

Impact

Unsafe names now fail before they reach the upstream command parser. Existing normal names, including multiword names, keep their exact argument form.

Checks

• pnpm install --frozen-lockfile
• pnpm typecheck
• pnpm exec vitest run test/viblib.test.ts -t "option-like" — 4 passed
• pnpm test — 23 passed
• pnpm check
• git diff --check origin/main..HEAD

Replaces #1, which only marked the plan as done.