feat(skills): bundle four agent skills + install tooling (0.6.1)

[caballeto]

Summary

Implements the CLI side of cowork/design/045-ai-skills-onboarding.md — Anthropic-spec Agent Skills bundled inside the DevHelm CLI, installable into any supported AI host (Cursor, Claude Code, Codex, Windsurf, Gemini, Claude Desktop) via `devhelm skills install`.

What lands in this PR

• 4 skills (`skills/`):
  • `devhelm-configure` — full write surface (monitors, alert-channels, notification-policies, resource-groups, dependencies, secrets, tags, webhooks, environments). Auto-detects MaC mode from repo signals.
  • `devhelm-investigate` — read-only triage: check results, incidents, forensic traces, audit log, uptime.
  • `devhelm-communicate` — status pages + components + public incidents + subscribers + custom domains.
  • `devhelm-manage` — API keys, environments, workspaces, entitlements. Safety rails on credential operations.
• 24 hand-written references (opinionated prose per resource, MaC recipes).
• 21 auto-generated field tables produced from the vendored OpenAPI spec by a new `scripts/generate-skill-references.mjs`; wired into `npm run build` and guarded by an openapi-drift test.
• 4 CLI subcommands (`src/commands/skills/`): install, bundle, schema, doctor.
• `skills/` shipped in the npm tarball via the `files` field.
• Version: 0.6.1 (additive, no breaking changes).

Tests

• 23 new tests across frontmatter validation, reference integrity, OpenAPI drift, install smoke-tests.
• Full suite: 893/893 passing, ESLint clean, `tsc --noEmit` clean.

User journey this unlocks

Post-signup in mono, the dashboard's `SetupCompleteScreen` will shortly gain an AI-setup panel that runs:

```bash
npm install -g devhelm
devhelm auth login --token=
devhelm skills install # auto-detects installed hosts
```

…after which the user can paste into Cursor:

Set up a monitor for https://your-site.com.

and the `devhelm-configure` skill drives the rest. Targets the design doc's <60s signup → first green monitor.

Design decisions worth flagging for review

• Intent-split, not resource-split — 4 skills keyed to user intent (configure / investigate / communicate / manage), matching Anthropic's recommendation and Checkly's shipped pattern. Resource-type split would dilute triggers and duplicate mode-detection/safety-rail prose.
• Sparse references over one monolithic SKILL.md — catalog cost ~400 tokens idle (4 × ~100), skills load on demand. SKILL.md bodies all ≤300 lines; every reference ≤500 lines (test-enforced).
• Hand-written + generated hybrid — hand-written provides opinion/defaults/gotchas; generated provides zero-drift field schemas. Link from hand-written to generated at the bottom of each.
• `devhelm skills install` not `npx @devhelm/skills` — users already have the CLI for auth, so a second install surface would be gratuitous. Matches Checkly's (`checkly install`) and Terraform's (provider in root tarball) shipped patterns.
• Claude Desktop zip fallback — Anthropic's desktop app doesn't read `.claude/skills/` from the filesystem; must be imported via Settings → Skills → Import. `devhelm skills bundle` produces the zip.

Test plan

• `npm run build && npm test && npm run lint && npm run typecheck` — all pass. ✅ (local)
• Manually run `devhelm skills install --target=cursor --path=/tmp/tstrepo`, open Cursor on that repo, confirm skills are discovered.
• Repeat for Claude Code (`--target=claude-code`).
• `devhelm skills bundle --out=/tmp/skills.zip` → import into Claude Desktop.
• `devhelm skills schema monitors` prints the generated field table.
• `devhelm skills doctor` reports the expected checks.

Made with Cursor