fix(cli): preserve installed skills when refresh fails

[rudycelekli]

Problem

A forced refresh deletes the installed registration before reading all replacement resources. A bad reference or failed write can therefore destroy a usable skill.

Changes

• Stage a complete replacement alongside the destination before touching the previous registration.
• Keep a backup through the final rename and restore it when replacement fails.
• Preserve ordinary install and force-update behavior, including external symlink target data.
• Report the retained backup path if restoring the previous registration also fails.

Verification

• Reproduced against unchanged main: focused regression tests 4 failed, 2 passed.
• Fixed branch: focused tests 6 passed; full suite 613 passed in 15.88s.
• Ruff check and git diff --check pass.
• MyPy still reports the same three pre-existing MCP SDK incompatibility errors as unchanged main; this patch adds none.

AI-assisted implementation and tests, independently reviewed before submission.