feat(artifacts): a shared skill follows its owner's folder; installers get Update

A skill in the Hub was a snapshot taken once: the owner changing
~/.claude/skills/<name> changed nothing there, and an installer had to
uninstall and install again to get a newer version.

- syncSkillSources (on GET /api/artifacts, at most every 15 s): a skill row
  taken from a folder — the owner's ~/.claude/skills/<name>, or the
  workspace's .claude/skills/<name> — is brought up to it. Only a folder
  whose names/sizes/mtimes changed is read again, with a pick's checks (no
  symlink, no secret, <= 5 MB, a member's files as theirs); a change is a
  NEW snapshot, the old one dropped, and an artifact_changed broadcast.
- artifacts.version (snapshot content hash) and source_hash (the folder's
  when last taken, additive columns): an upload or a Hub edit records the
  folder as it is then, so only a LATER folder change replaces it.
- A list row's updateAvailable: installed, and the viewer's copy differs
  from version. The page shows Update (a pack: Update N); install with
  {update: true} replaces the copies (old ones moved aside) and is not
  counted as another install.

server/db.js

@@ -964,9 +964,15 @@ try {
 // (`captureOutputs`), not pinned by hand. `suggested_owner_id`: for a row with
 // no owner, the user whose folder the session ran in — they may claim it or
 // say it is not theirs (`claim`/`decline`); an admin assigns any (`assign`).
+// `version`: a skill snapshot's content hash; `source_hash`: its source
+// folder's hash when last taken — a skill follows its owner's folder and an
+// installer whose copy differs from `version` is offered Update
+// (`syncSkillSources`/`updateCheck`). NULL until first computed.
 for (const [col, ddl] of [
   ["auto", "auto INTEGER NOT NULL DEFAULT 0"],
   ["suggested_owner_id", "suggested_owner_id INTEGER"],
+  ["version", "version TEXT"],
+  ["source_hash", "source_hash TEXT"],
 ]) {
   try {
     db.prepare(`SELECT ${col} FROM artifacts LIMIT 1`).get();