npx-managed skills stay copies so an installer update cannot land in the repo by accident; knowledge is a symlink outside home/ so maintain writes are tracked instead of dying on the next apply. Verified the live ~/.agents/knowledge link and that the lockfile is named dot_skill-lock.json so chezmoi does not ignore it.
Co-authored-by: Cursor <cursoragent@cursor.com>