fix: address Copilot review round 14 on #2248

**The TUI ignored `incomplete`.** Round 12 added that field precisely so a
consumer could tell "not fully checked" from a real failure, and then the one
client that reads the report did not consume it — which made the field
decorative. The pane shows an Incomplete: block with the report's own reason,
and the status line reads INCOMPLETE rather than FAILED.

It sits ABOVE the manifest, not beside the status line: it explains the list
that follows — only the first N rows were fetched, the rest stay marked `·`
because nobody looked at them — and below a 512-row manifest it would be
off-screen, which is the same as absent. Found by writing the test, whose
first version asserted against a 600-entry fixture and could see neither
string. The test triggers truncation through the BYTE budget instead, so the
manifest stays three rows and the assertions measure the pane rather than the
test's viewport.

**The capped self-entry was reported under the wrong URI.** A manifest may
write its self-entry in a normalized-equivalent form; the fallback recorded
`entry.uri`, so manifest rows keyed on the declared spelling matched nothing
while the normalized extra-files filter suppressed it as already covered. The
verdict existed in the report and appeared nowhere on screen. Recorded under
`declaredSelf.uri` now.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ND46Ci64DC3tzBy9aG81Nc
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/test/core/mcp/skillsVerification.test.ts

@@ -702,6 +702,38 @@ describe("verifySkills (#2248)", () => {
     expect(report.files[0].status).toBe("mismatch");
   });
 
+  it("reports the capped self-entry under the URI the MANIFEST declared", async () => {
+    // A manifest may write its self-entry in a normalized-equivalent form. The
+    // fallback recorded `entry.uri`, so a consumer matching rows against the
+    // manifest found nothing — while a normalized "extra files" filter
+    // suppressed it as already covered. The verdict existed in the report and
+    // appeared nowhere on screen (Copilot).
+    const declaredSpelling = "skill://huge/x/../SKILL.md";
+    const skill: SkillEntry = {
+      uri: "skill://huge/SKILL.md",
+      frontmatter: { name: "huge", description: "Listed" },
+      resources: [
+        ...Array.from({ length: 600 }, (_, i) => ({
+          uri: `skill://huge/f${i}.md`,
+          digest: `sha256:${"a".repeat(64)}`,
+          size: 1,
+        })),
+        { uri: declaredSpelling, digest: `sha256:${"b".repeat(64)}`, size: 1 },
+      ],
+    };
+    const readResource = vi.fn(async (uri: string) => ({
+      result: { contents: [{ uri, text: "x" }] },
+    }));
+    const client = { readResource } as unknown as InspectorClientProtocol;
+    const [report] = await verifySkills(client, [skill]);
+    const self = report.files.find((f) => f.uri === declaredSpelling);
+    expect(self?.status).toBe("mismatch");
+    // …and NOT under the entry's own spelling, which no manifest row carries.
+    expect(report.files.some((f) => f.uri === "skill://huge/SKILL.md")).toBe(
+      false,
+    );
+  });
+
   it("does not truncate a conforming manifest", async () => {
     // A conforming skill totals at most 16 MiB by definition, so the bound
     // must never shorten one — otherwise it would trade a hostile-server