Pin Keito skill installer package

[sionsmith]

Summary

• pin the keito skill install npm installer hop to skills@1.5.6 instead of a floating installer package
• set the default skill source to the public GitHub repo osodevops/keito-skill
• keep the skill source as GitHub; npm is only used to execute the pinned open skills installer package
• document the install model in the README and add the CI badge
• update CLI help/errors so they do not advertise a bare npx skills add flow
• keep the fake npx integration test aligned with the pinned package
• bump CLI release version to 0.1.6 with changelog entry

Verification

• cargo fmt --check
• cargo test
• cargo clippy --all-targets -- -D warnings
• stale repo scan: no keito-ai/keito-skill references
• floating skills installer scan: no floating installer package or bare npx skills add references
• floating GitHub Actions scan: no workflow action refs using @v*, @main, @master, or @latest