plus regression test for Failed->Skipped transition (#126)

## #125 — silent resume-skip

When resume encounters a package whose state is already \`Published\` or
\`Skipped\`, the sequential path short-circuited with a stdout info line
and \`continue\`, without recording an event. Since \`events.jsonl\` is
the **authoritative audit log** (state.json is a projection of it),
this left a user-visible gap: an auditor reading only events.jsonl
couldn't tell "resume looked at this package and trusted its terminal
state" from "resume never touched this package." Surfaced by the
synthetic rehearsal test (\`e2e_rehearse.rs\`, PR #124).

**Fix:** emit a \`PackageSkipped { reason: \"resume: state already <s>\" }\`
event in the already-complete match arm. No receipt entry is pushed —
the receipt vector has always excluded already-terminal packages on
the resume path, and callers depend on that shape (e.g.
\`run_resume_runs_publish_when_state_exists\`). Only the audit-trail
behavior changes.

## #126 — Failed->Skipped state drift

The issue speculated that resume's stdout-said-Skipped but
state.json-still-says-Failed could indicate \`update_state\` not firing
on the version-exists short-circuit when the prior state was Failed.

**Finding:** the current sequential code handles this correctly —
\`reg.version_exists(p) \=\\= true\` triggers
\`update_state(Skipped)\` which flushes to state.json, and a targeted
test (\`resume_from_failed_ambiguous_updates_state_to_skipped_when_registry_visible\`)
passes without any code change. The observation in the issue may have
been a stale-state-file artifact in the synthetic rehearsal fixture.

Landing the test anyway as a regression guard: if a future refactor
breaks this semantics (e.g. parallel mode taking a different path, or
state write getting clobbered), the guard fires immediately.

## Tests

Two new \`#[serial]\` tests in \`engine::tests\`:
- \`resume_emits_package_skipped_event_for_already_published_state\`
  — seeds state with Published, runs \`run_publish\`, asserts
  \`PackageSkipped\` appears in events.jsonl.
- \`resume_from_failed_ambiguous_updates_state_to_skipped_when_registry_visible\`
  — seeds state with Failed{Ambiguous}, registry returns 200, asserts
  reloaded state.json shows Skipped.

All 49 existing resume/publish tests remain green.