feat(vendor): --exclude plus content-type selection (--types/--exclude-types)

vendor add gains --exclude a,b,c (all mode minus those ids) as the mirror
of --include, for taking the majority of a source while dropping a few
items. Mutual exclusion with --include is a hard error, unknown ids fail
naming the available ones (generalized checkIDEntries).

vendor add and vendor select gain --types (allow-list) and --exclude-types
(deny-list) over the four content types. The filter is stored as the
optional, v2-compatible Selection.exclude_types field and survives vendor
update: new upstream items of an excluded type never enter the work
repository (unlike id expansion, which would silently re-admit them).
--types/--exclude-types replace the filter on select, absent flags keep
it, and --mode all clears it along with include/exclude.

Also fixes materializeTree to create the staging directory for an empty
selection — previously select-to-zero failed at the staging rename.

README.md

@@ -89,11 +89,23 @@ executed.
 - Default: vendor **everything** (`mode: all`).
 - `--include a,b,c` switches the source to **include mode**: only those ids
   arrive, and new upstream items do **not** arrive automatically.
+- `--exclude a,b,c` keeps **all mode** minus those ids — for taking the
+  majority of a source while dropping a few items.
+- `--types skills,commands` (**allow-list**) and `--exclude-types agents,mcp`
+  (**deny-list**) filter whole content types. The filter is stored as
+  `exclude_types` in the lockfile and **survives updates**: new upstream items
+  of an excluded type never enter the work repository. `--types` covering all
+  four types normalizes to no filter; excluding all four fails at the
+  zero-selection guard.
 - Hard errors, enforced by `vendor add`, `vendor update`, `vendor select`
   and `validate`:
   - `all` combined with an include list → error
   - an exclude list without `all` → error (not supported in v2 selections)
-  - an include entry that no longer exists upstream → error naming the item
+  - an include or exclude entry that no longer exists upstream → error naming the item
+  - `--include` combined with `--exclude` → error
+  - `--types` combined with `--exclude-types` → error
+  - unknown type names → error listing `skills, commands, agents, mcp`
+  - an include entry belonging to a type the type filter excludes → error
 
 (`vendor select` changes selections later — see
 [Changing your selection later](#changing-your-selection-later) below.)
@@ -107,6 +119,7 @@ advancing the pinned revision (that is `vendor update`'s job):
 agent-lib vendor select superpowers --add tdd,brainstorm   # include mode: grow
 agent-lib vendor select superpowers --remove review,debug  # include mode: shrink
 agent-lib vendor select superpowers --remove review        # all mode: move to exclude
+agent-lib vendor select superpowers --types skills         # replace the type filter
 agent-lib vendor select superpowers --mode all             # reset: take everything again
 ```
 
@@ -116,8 +129,11 @@ agent-lib vendor select superpowers --mode all             # reset: take everyth
 - **all mode**: `--remove` moves ids onto the exclude list (lockfile v2
   supports exclude in all mode) and deletes their folders; `--add` is a hard
   error — everything is already selected.
-- `--mode all` clears include/exclude and re-materializes the full pinned
-  upstream, reporting what appeared.
+- `--types` / `--exclude-types` **replace** the content-type filter
+  (same semantics as on `vendor add`); when neither flag is passed, the
+  stored filter stays as-is.
+- `--mode all` clears include/exclude **and the type filter** and
+  re-materializes the full pinned upstream, reporting what appeared.
 
 Every select re-runs the collision checks and honors the lockfile rename map
 — you can hand-add a rename for a not-yet-selected item, then `--add` it