codev update: dry-run silently omits skills, and skipExisting freezes stale skill copies forever #1222

Two defects in codev update's skill handling (found live, 2026-07-22)

1. Dry-run silently omits the skills category

update.ts wraps the entire skills step in if (!dryRun) (line ~223). Under --dry-run, no skills are copied — correct — but nothing is reported either. Observed: a project missing the arch-init skill ran codev update --dry-run and the preview listed CLAUDE/AGENTS conflicts, tier files, and gitignore entries, but gave no hint that a real update would install a new skill. The preview must enumerate what apply would do: run copySkills in a report-only mode (or compute the copied/skipped sets without writing) and print + (would add) .claude/skills/<name>/.

2. skipExisting: true freezes existing skills forever

Update calls copySkills(targetDir, templatesDir, { skipExisting: true }) — new skills are added, but an existing skill directory is never refreshed, even when the local copy is a byte-for-byte unmodified old shipped default. Observed: a project holding the pre-auto-save arch-init will keep it through every future codev update, silently — no report, no refresh. This is the #1210 drift failure-mode ("stale local copy of an old default shadowing the current version") reproduced inside the updater itself.

Preserving customized skills is the right default. But "unmodified old default" is not a customization. Options, weakest to strongest:

• Report-only (minimum): when an existing skill differs from the skeleton's version, print ~ (differs from shipped — preserved; use --force or delete to refresh). Never silent.
• Hash-known-defaults (better, shares machinery with codev doctor: detect protocol-file drift — local copies shadowing newer skeleton files, and stale installed skeletons #1210): ship hashes of historical skill versions; a local copy matching an old default hash is provably rot → refresh it; anything else → preserve + report.

Acceptance sketch

• --dry-run output includes a line per skill that apply would add, and per existing skill that differs from the shipped version.
• Real update refreshes (or at minimum reports) stale unmodified skills; genuinely customized skills preserved + reported.
• scaffold.test.ts copySkills tests extended for whatever report-only/refresh mode is added.

Related: #1210 (drift detector — this is the updater-side leg of the same silent-staleness family).

Area: area/scaffold.