feat(vendor): select command — manage include/exclude selection after initial add

vendor select <name> --add/--remove/--mode all changes what a source
contributes without advancing the pinned rev: ids are validated against
the pinned upstream (typos abort listing available ids), collisions
re-run, renames from the lockfile are honored, and the external area is
rewritten via the same staging-swap as update. include mode grows and
shrinks the include list; all mode --remove moves ids onto exclude;
--mode all resets to everything. Failed selects mutate nothing.

Closes beads: agent-lib-cd3

README.md

@@ -69,11 +69,40 @@ never executed.
 - Default: vendor **everything** (`mode: all`).
 - `--include a,b,c` switches the source to **include mode**: only those ids
   arrive, and new upstream items do **not** arrive automatically.
-- Hard errors, enforced by `vendor add`, `vendor update` and `validate`:
+- Hard errors, enforced by `vendor add`, `vendor update`, `vendor select`
+  and `validate`:
   - `all` combined with an include list → error
   - an exclude list without `all` → error (not supported in v2 selections)
   - an include entry that no longer exists upstream → error naming the item
 
+(`vendor select` changes selections later — see
+[Changing your selection later](#changing-your-selection-later) below.)
+
+### Changing your selection later
+
+`vendor select` manages the selection after the initial add — without ever
+advancing the pinned revision (that is `vendor update`'s job):
+
+```sh
+agent-lib vendor select superpowers --add tdd,brainstorm   # include mode: grow
+agent-lib vendor select superpowers --remove review,debug  # include mode: shrink
+agent-lib vendor select superpowers --remove review        # all mode: move to exclude
+agent-lib vendor select superpowers --mode all             # reset: take everything again
+```
+
+- **include mode**: `--add` appends ids (validated against the pinned
+  upstream — typos abort with the list of available ids), `--remove` drops
+  ids and deletes their folders from `external/`.
+- **all mode**: `--remove` moves ids onto the exclude list (lockfile v2
+  supports exclude in all mode) and deletes their folders; `--add` is a hard
+  error — everything is already selected.
+- `--mode all` clears include/exclude and re-materializes the full pinned
+  upstream, reporting what appeared.
+
+Every select re-runs the collision checks and honors the lockfile rename map
+— you can hand-add a rename for a not-yet-selected item, then `--add` it
+under its deployed name. Failed selects mutate nothing.
+
 ### Collisions and renames
 
 Every item deploys into a flat per-type namespace. If a vendored id collides