feat: Skills extension phase 3 — CLI, TUI, directory reads, frontmatter check

Closes #2248.

Completes SEP-2640 support across all three clients, and closes the one
obligation #2234 deliberately left open.

- `checkSkillFrontmatterMatch` compares a served SKILL.md's own YAML
  frontmatter against the entry the listing advertised, field by field. No
  digest can cover this: a digest is taken over the bytes the server served,
  so it proves the file was not altered in transit and says nothing about
  whether the listing described it honestly. Needs a real YAML parser; `yaml`
  was already a root dependency, so this adds no package — but it does newly
  put it on core/'s import graph, hence the three bundler `external` lists.

- `resources/directory/read`: result schemas defined against the normative
  text, `InspectorClient.readResourceDirectory`, a Directory section on the
  Skills screen, and `--method resources/directory/read` in the CLI. The
  client refuses the call locally when the server did not declare
  `directoryRead`, which is the SEP's MUST NOT. A child the directory lists
  but the entry does not is marked `not listed` rather than merged into the
  manifest — the SEP calls a directory result a live observation and forbids
  treating it as extending the manifest.

- CLI: `skills/list`, `skills/get` and `resources/directory/read`, plus
  `--verify` — one NDJSON report per skill, a summary on stderr, exit 7 on a
  violation. Reads are sequential; a conforming manifest may declare 512
  entries.

- TUI: a Skills pane, shown only when the server declares the extension. Each
  row carries its conformance verdict as a glyph as well as a colour, since
  the pane is read over ssh and through script(1). Enter verifies.

- `verifySkills` re-throws `AuthRecoveryRequiredError` rather than recording
  it per file: it says the session's authorization expired, so absorbing it
  would report N identical read failures and swallow the error the TUI and
  the web commands key off to reauthorize.

Two open questions settled, both in code comments where they will be found:
`skills/get` carries no caching attributes because SEP-2640 leaves the
question open in as many words, so requiring them would fail a conforming
server; and there is no `PagedSkillsState` because every consumer of this
list is a whole-catalog verdict — computed over page one of three, "this
server's skills conform" is not merely partial but wrong.

The fixture grows two skills, both for checks that were otherwise
undemonstrable: `lying-listing` (listing and file disagree, digest still
verifies) and `stale-manifest` (serves a file its manifest does not declare).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ND46Ci64DC3tzBy9aG81Nc
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/cli/src/cli.ts

@@ -679,7 +679,14 @@ async function parseArgs(argv?: string[]): Promise<ParseResult> {
       parseKeyValuePair,
       {},
     )
-    .option("--uri <uri>", "URI of the resource (for resources/read method)")
+    .option(
+      "--uri <uri>",
+      "URI of the resource (resources/read, resources/directory/read) or of the skill (skills/get)",
+    )
+    .option(
+      "--cursor <cursor>",
+      "Opaque pagination cursor (for resources/directory/read; pass back the nextCursor from the previous page).",
+    )
     .option(
       "--prompt-name <promptName>",
       "Name of the prompt (for prompts/get method)",
@@ -743,6 +750,10 @@ async function parseArgs(argv?: string[]): Promise<ParseResult> {
       "--strict",
       "Report tool-schema portability problems in full (path, issue, suggested fix) on stderr, and exit 6 if any is error-severity. Use with --method tools/list. Without it, a one-line count is printed instead.",
     )
+    .option(
+      "--verify",
+      "Run the SEP-2640 conformance and digest checks over the skills returned, emit one JSON report per skill on stdout, and exit 7 if any fails. Use with --method skills/list or --method skills/get.",
+    )
     .option(
       "--connect-timeout <ms>",
       `Connection timeout in ms (default ${DEFAULT_CONNECT_TIMEOUT_MS} for ad-hoc --server-url / target invocations; 0 = no timeout).`,
@@ -848,6 +859,8 @@ async function parseArgs(argv?: string[]): Promise<ParseResult> {
     header?: Record<string, string>;
     appInfo?: boolean;
     strict?: boolean;
+    verify?: boolean;
+    cursor?: string;
     connectTimeout?: number;
     format?: OutputFormat;
     toolArgsJson?: string;
@@ -919,6 +932,18 @@ async function parseArgs(argv?: string[]): Promise<ParseResult> {
     }
   }
 
+  // `--verify` is checked here for exactly the reason `--strict` is: the
+  // short-circuit returns below never reach `runMethod`, so validating further
+  // down would let `--verify --method servers/list` succeed while silently
+  // ignoring a flag documented as skills-only.
+  if (options.verify) {
+    if (options.method !== "skills/list" && options.method !== "skills/get") {
+      throw new Error(
+        "--verify requires --method skills/list or --method skills/get.",
+      );
+    }
+  }
+
   // State-path precedence (getStateFilePath): MCP_INSPECTOR_OAUTH_STATE_PATH →
   // <MCP_STORAGE_DIR>/oauth.json → ~/.mcp-inspector/storage/oauth.json — the
   // same file the web backend writes, so tokens are shared across surfaces.
@@ -1147,6 +1172,8 @@ async function parseArgs(argv?: string[]): Promise<ParseResult> {
     toolMeta: options.toolMetadata,
     appInfo: options.appInfo === true,
     strict: options.strict === true,
+    verify: options.verify === true,
+    cursor: options.cursor,
     format: options.format,
   };