[Audit] Refactor install.ts: extract 726-line execute() into smaller functions

[rohitg00]

Problem

packages/cli/src/commands/install.ts has a single execute() method spanning 726 lines. It handles:

1. Provider detection & validation
2. Well-known URL discovery
3. Git cloning & skill discovery
4. List mode
5. Skill filtering (--skills flag)
6. Interactive skill selection
7. Agent selection
8. Install method selection
9. Quality checking
10. Security scanning
11. Confirmation prompt
12. Actual file installation (copy/symlink)
13. npm dependency installation
14. Metadata saving
15. AGENTS.md updates
16. Summary display
17. Skills.sh stats
18. Pro tips

This violates single responsibility and makes the command hard to test, debug, and extend.

Proposed Solution

Extract into focused private methods:

async execute() {
  const provider = await this.resolveProvider();
  const skills = await this.discoverSkills(provider);
  const selected = await this.selectSkills(skills);
  const agents = await this.selectAgents();
  const method = await this.selectMethod(agents);
  await this.runSecurityScan(selected);
  const results = await this.performInstall(selected, agents, method);
  this.showResults(results);
}

Also extract duplicated skill/agent selection patterns that appear in:

• install.ts (lines 275-316)
• onboarding/index.ts (lines 156-241)
• agent.ts
• find.ts

Acceptance Criteria

• execute() under 50 lines
• Each extracted method under 80 lines
• No behavior changes — same UX, same flags
• Build passes, existing tests pass