Add `skillfile list` command for human-friendly listing of managed entries

[eljulians]

skillfile status is great for checking runtime state (lock SHAs, modified/pinned annotations), but sometimes you just want to see what's in your Skillfile and where it comes from. Every package manager has a list command (brew list, pip list, npm list)

$ skillfile list
Skills (6):
  browser          github  anthropics/skills          main
  python-pro       github  obra/superpowers           main
  commit           local   .claude/skills/commit.md
  rust-dev         url     https://example.com/rust.md

Agents (2):
  code-refactorer  github  anthropics/skills          main
  reviewer         local   .claude/agents/reviewer.md

Install targets: claude-code (global), cursor (local)

Shows name, source type, source location, and ref. Grouped by entity type. No network calls, no runtime state, just "what's declared and where does it come from."

Optional flags:

• --json for scripting
• --names-only for piping into other commands
• --skills / --agents to filter by entity type

The distinction from status: list answers "what's in my Skillfile?", status answers "what's the state of my entries?" (locked/unlocked, SHAs, pinned, modified, outdated). Same split as brew list vs brew outdated.

Probably to be implemented in cli/src/commands/list.rs