flags-sdk: use scoped skill identifier for vercel-cli install (#419)

Replace the raw `npx skills add https://github.com/vercel/vercel --skill
vercel-cli` command with the scoped `vercel/vercel@vercel-cli` identifier
and reframe it as a user-facing suggestion rather than an agent
auto-install. Addresses Snyk audit W012 (unverifiable external
dependency / runtime URL that controls the agent).