[00200200]

Closes #18

Summary of Changes

• Implemented Git-native remote skill package manager in src/cinch/package.py:
  • cinch install <git_url_or_shorthand>: Supports shorthands like gh:owner/repo@v1, full git URLs, and local directory paths with tag/branch/commit pinning.
  • cinch update [name]: Re-fetches remote sources, updates deterministic commit SHA & SHA-256 checksums, and updates vendor trees.
  • cinch uninstall <name>: Cleanly uninstalls vendored skill files and removes lockfile tracking.
  • Deterministic version pinning and checksum verification stored in cinch.lock.
  • Offline caching in ~/.cache/cinch/remotes/ (configurable via CINCH_CACHE_DIR).
  • Vendors remote skills into .skills/vendor/<name>/.
• Integrated package discovery in src/cinch/inventory.py so cinch discovers skills inside .skills/vendor/.
• Added CLI subcommands install, update, and uninstall to src/cinch/cli.py.
• Comprehensive test coverage in tests/test_package.py with local fixture repositories, multi-skill repository installation, update, uninstall, checksum, CLI workflows, and inventory integration.
• Pure Python 3.11+, zero external dependencies, passes Ruff lint and format.

[github-actions]

👋 Thanks for opening this pull request, @00200200!

We're thrilled to have your contribution to cinch! Here is a quick checklist to help get your PR merged smoothly:

• Linked Issue: Issue reference detected in PR body. ✅
• Local Verification: Verify all checks pass locally using uv run pytest and uv run ruff check ..
• Commit Hygiene: Ensure commit messages follow conventional commit style (feat:, fix:, docs:).

A maintainer will review your code shortly. Feel free to ping in comments if you have any questions! 🚀