feat: implement extends resolution, --force update, and parent merge in export

[tianhaocui]

What

Implement extends resolution in install, add --force flag for updates, and merge parent agent content in export --format claude-code.

Why

The spec (Section 15: Inheritance) defines extends with clear merge rules, but the implementation was completely missing:

• extends field is parsed but never acted on — install only handles dependencies
• install skips if target exists — no way to update without manual rm -rf
• export only reads current directory — ignores installed parent agent
• Git source detection hardcoded to github.com — Bitbucket/GitLab repos fail

This means the core cross-project sharing workflow described in the README doesn't work.

Closes #53

How Tested

• npm run build passes
• gitagent validate passes on example agents
• Manual testing (describe below)

Tested with:

• Bitbucket private repo via SSH (git@bitbucket.org:org/shared-agent.git)
• extends in child agent.yaml → gitagent install clones to .gitagent/parent/
• gitagent install --force removes and re-clones
• gitagent export --format claude-code -o CLAUDE.md merges parent SOUL.md, RULES.md, and skills/
• Child SOUL.md replaces parent, child RULES.md appends to parent, child skills shadow parent

Checklist

• My code follows the existing style of this project
• I have added/updated tests (if applicable)
• I have updated documentation (if applicable)
• I have read the CONTRIBUTING.md

[shreyas-lyzr]

Reviewed and merged with fixes.

What was good:

• extends resolution is a meaningful feature — the spec defined it but it was never implemented
• Merge rules are correct per spec Section 15 (child SOUL replaces parent, child RULES appends, skills union with child shadowing)
• --force flag is useful for updates
• isGitSource() supporting GitHub, Bitbucket, and GitLab is a good broadening

Fixes applied before merge:

1. Command injection — cloneGitRepo used execSync with string interpolation (\git clone ... "${source}"`). Replaced with execFileSync('git', [...args])` per the security fix in PR fix: replace execSync string interpolation with execFileSync to prevent command injection #48.
2. Shell cp -r calls — Two execSync(\cp -r ...`)calls replaced withcpSync()` (same fix pattern as PR fix: replace execSync string interpolation with execFileSync to prevent command injection #48).
3. export.ts / import.ts skipped — These changes overlapped with the already-merged PR fix(issue,53): fixed duplicated required options in export and import #60 fix. Only install.ts and claude-code.ts were taken from this PR.

Note for future work:

• Parent merge only applies to claude-code export. Other adapters (system-prompt, cursor, opencode, etc.) don't resolve extends. This should be generalized — probably at the loader level rather than per-adapter.
• No tests included. Would be good to add tests for extends resolution.

Thanks @tianhaocui!