rune v0.4.0

Architecture:
- Lockfile (.claude/rune.lock): records hash + registry_commit per skill,
  enabling reproducible installs and accurate drift detection
- Modified flag detection: sync compares local hash to lockfile, sets
  pedigree modified=true for imported skills changed locally
- Content-based drift direction replaces unreliable mtime comparison
- File locking (flock) prevents concurrent cache corruption
- Archive etag caching skips redundant tarball downloads
- sync --force required to overwrite locally modified skills
- add/remove update lockfile immediately

New commands and flags:
- rune status: combined summary (registries + project + upstream)
- rune clean: purge stale cache entries for removed registries
- --dry-run global flag on sync/push/update/clean
- --message on push for custom commit messages
- --force on sync to overwrite local modifications

Polish:
- Colored output with isatty detection
- Safer settings.json handling (backup, better errors)
- doctor respects --project flag
- 47 tests (up from 17), clippy clean