feat(artifacts): last updated time on skills and files; each installer's copy marked

A row said nothing about when its content last changed, and the install list
could not tell who still runs an old version. `artifacts.version_at` (new
column, existing rows from `updated_at`) is stamped only when a snapshot is
replaced — a rename or share toggle leaves it — and served as `versionAt`:
skill and file rows read "Updated 3h ago", the detail sheet "Last updated".
`GET /api/artifacts/:id/installs` gives each skill install a `state` —
latest / outdated / removed / unknown — from its Claude skill copies' hash
against the newest snapshot, shown as a badge.

server/lib/artifacts.js

@@ -173,6 +173,8 @@ function view(row, req, owners = null) {
     suggestedForMe: !!req?.user && row.owner_id == null && row.suggested_owner_id === req.user.id,
     createdAt: row.created_at,
     updatedAt: row.updated_at,
+    // When its content last changed (a new snapshot): a page or plugin never does.
+    versionAt: row.version_at || row.created_at,
   };
 }
 
@@ -627,7 +629,7 @@ async function captureOutputsNow(laneId, sessionId) {
     const files = JSON.stringify([{ path: shot.name, size: shot.size, mtime: mtimeMs }]);
     if (row) {
       sql(
-        "UPDATE artifacts SET snapshot = ?, files = ?, size = ?, session_id = ?, updated_at = strftime('%Y-%m-%dT%H:%M:%fZ','now') WHERE id = ?"
+        "UPDATE artifacts SET snapshot = ?, files = ?, size = ?, session_id = ?, updated_at = strftime('%Y-%m-%dT%H:%M:%fZ','now'), version_at = strftime('%Y-%m-%dT%H:%M:%fZ','now') WHERE id = ?"
       ).run(shot.snap.id, files, shot.size, String(sessionId), row.id);
       dropSnapshot(row.snapshot);
       done.push(sql("SELECT * FROM artifacts WHERE id = ?").get(row.id));
@@ -1641,7 +1643,8 @@ function editSkill(req, row, { name, description, content }) {
   sql(
     `UPDATE artifacts SET source = ?, snapshot = ?, files = ?, size = ?, description = ?,
             version = ?, source_hash = ?,
-            updated_at = strftime('%Y-%m-%dT%H:%M:%fZ','now') WHERE id = ?`
+            updated_at = strftime('%Y-%m-%dT%H:%M:%fZ','now'),
+            version_at = strftime('%Y-%m-%dT%H:%M:%fZ','now') WHERE id = ?`
   ).run(
     n,
     snap.id,
@@ -2027,7 +2030,8 @@ function replaceSnapshot(row, files, sourceHash) {
       : row.description;
   sql(
     `UPDATE artifacts SET snapshot = ?, files = ?, size = ?, version = ?, source_hash = ?,
-            description = ?, updated_at = strftime('%Y-%m-%dT%H:%M:%fZ','now') WHERE id = ?`
+            description = ?, updated_at = strftime('%Y-%m-%dT%H:%M:%fZ','now'),
+            version_at = strftime('%Y-%m-%dT%H:%M:%fZ','now') WHERE id = ?`
   ).run(
     snap.id,
     JSON.stringify(next),
@@ -2308,6 +2312,36 @@ async function uninstall(req, id) {
  * the installer and an admin. `unrecorded` = installs counted before this
  * list was kept.
  */
+/**
+ * Where one recorded install of a skill stands now, from its Claude
+ * `skills/<name>` copies (one per account it went into; the cross-tool
+ * `~/.agents/skills` twins are the same files) —
+ * `outdated` when any differs from the row's newest snapshot (its user is
+ * offered Update), `removed` when none is there any more, `unknown` when one
+ * is there but unreadable as a skill, else `latest`. Only hashes are
+ * compared; no content leaves the server. The paths are the ones the server
+ * itself recorded at install, read like `updateCheck` reads the viewer's own.
+ */
+function installState(row, paths) {
+  const version = snapshotVersion(row);
+  const dirs = (Array.isArray(paths) ? paths : []).filter(
+    (p) =>
+      typeof p === "string" &&
+      path.basename(p) === row.source &&
+      path.basename(path.dirname(p)) === "skills" &&
+      path.basename(path.dirname(path.dirname(p))) !== ".agents"
+  );
+  if (!version || !dirs.length) return "unknown";
+  const states = dirs.map((dir) => {
+    const st = folderState(dir, path.dirname(path.dirname(dir)));
+    if (st) return st.hash === version ? "latest" : "outdated";
+    return exists(dir) ? "unknown" : "removed";
+  });
+  if (states.includes("outdated")) return "outdated";
+  if (states.every((x) => x === "removed")) return "removed";
+  return states.includes("unknown") ? "unknown" : "latest";
+}
+
 function installsOf(req, id) {
   const row = load(req, id);
   const u = req?.user;
@@ -2331,6 +2365,7 @@ function installsOf(req, id) {
       mine,
       at: r.installed_at,
       replaced: r.replaced === 1,
+      ...(row.kind === "skill" ? { state: installState(row, paths) } : {}),
       ...(mine || u?.role === "admin" ? { paths } : {}),
     };
   });