Allow opting out of auto-update and of the automatic `bl skill init` after updates

Start with packages/runtime/src/utils/update-checker.ts and packages/core/src/config/loader.ts to trace automatic updates and persistent settings, then inspect packages/commands/src/commands/update.ts and the bl skill init entry point. Verify the two switches independently prevent implicit npm updates and skill synchronization while preserving the update notice and explicit skill initialization behavior.

bl currently self-updates silently and then unconditionally re-runs bl skill init, with no persistent way to opt out of either step.

What happens

1. Any command (e.g. a scheduled bl usage token-plan) triggers shouldAutoUpdate() when the installed version is a major behind, or more than 3 minors behind (packages/runtime/src/utils/update-checker.ts). It then runs npm install -g bailian-cli@latest in the middle of the user's command.
2. On success, syncAgentSkillsAfterUpdate() runs bl skill init, which symlinks every bailian-* skill into every detected agent directory (~/.claude/skills, ~/.codex/skills, ~/.config/opencode/skills, ~/.pi/agent/skills, ~/.agents/skills, …). bl update does the same via updateAgentSkill() (packages/commands/src/commands/update.ts).
3. The only gate is ctx.settings.quiet, which comes from the per-invocation --quiet flag and is not a config.json key (packages/core/src/config/loader.ts), so it cannot be made persistent. bl skill init itself has no flags to limit targets.

Why this is a problem

Users who manage their agent skill directories elsewhere (dotfiles, a config-as-code repo) have their removals silently reverted on the next update. In my case 10 skills I had removed came back into five agent homes because a cron-style quota probe happened to run after 1.24.0 was published (telemetry: skill init at 2026-09-11T13:48:04Z, cliVersion 1.24.0, immediately after an in-flight 1.20.0 usage token-plan).

Request

Two independent, persistent switches (config.json key and/or env var), e.g.:

• BAILIAN_AUTO_UPDATE=0 / "auto_update": false — never run npm install -g implicitly; only print the "update available" notice.
• BAILIAN_SKILL_SYNC=0 / "skill_sync": false — never run bl skill init implicitly after an update (both the auto path and bl update).

Optionally, bl skill init --agent <list> so the sync can be scoped even when enabled.

Environment: bl 1.24.0, npm global install, macOS 26.6, node v26.8.2.