[Feature] Version pinning and lock file (skillkit.lock) #91

Problem

SkillKit has no way to pin skill versions or ensure reproducible installs:

• npm has package-lock.json, pip has requirements.txt, cargo has Cargo.lock
• Two developers running skillkit install at different times get different skill versions
• No rollback mechanism — can't revert to a known-good skill version
• Product Hunt users flagged "embedding drift" as a concern when the semantic store grows

Proposed Solution

skillkit.lock

Auto-generated lock file tracking installed skill versions:

{
  "lockfileVersion": 1,
  "skills": {
    "pdf": {
      "source": "anthropics/skills",
      "version": "2.1.0",
      "integrity": "sha256-...",
      "installedAt": "2026-04-07T...",
      "agents": ["claude-code", "cursor"]
    }
  }
}

Commands

• skillkit install — auto-generates/updates lock file
• skillkit install --frozen — install from lock file only (CI mode), fail if lock is stale
• skillkit update — updates lock file after re-fetching
• skillkit pin <skill> --version <version> — pin specific version

Versioning

• Requires skill.json ([Feature]: Read skill.json from source repos for install, recommend, and translate #83) with version field
• Falls back to git commit SHA when no version exists
• skillkit outdated — show skills with newer versions available

References

• skill.json support: [Feature]: Read skill.json from source repos for install, recommend, and translate #83
• npm lockfile v3 spec for design inspiration