Fetch the skills from npm and add the doctor version check

[DominicFrei]

Completes the two remaining pieces of the install work.

• install now fetches the latest published @gaffa-dev/skills from npm, so a skills change reaches users without a CLI release. A local checkout still works through --skills-dir or GAFFA_SKILLS_DIR. If the fetch fails, it errors clearly and writes nothing.
• doctor compares the installed receipts against the published version and prints one line when a newer one exists. An unreachable registry is reported and the rest of the report still runs. The json output skips the check so it stays offline and stable.
• Verified live against the registry: a clean install pulls 0.1.0 with all four skills, and doctor flags an older receipt.

Refs GAF-668.