feat: Skills extension phase 3 — CLI, TUI, directory reads, frontmatter check

Closes #2248.

Completes SEP-2640 support across all three clients, and closes the one
obligation #2234 deliberately left open.

- `checkSkillFrontmatterMatch` compares a served SKILL.md's own YAML
  frontmatter against the entry the listing advertised, field by field. No
  digest can cover this: a digest is taken over the bytes the server served,
  so it proves the file was not altered in transit and says nothing about
  whether the listing described it honestly. Needs a real YAML parser; `yaml`
  was already a root dependency, so this adds no package — but it does newly
  put it on core/'s import graph, hence the three bundler `external` lists.

- `resources/directory/read`: result schemas defined against the normative
  text, `InspectorClient.readResourceDirectory`, a Directory section on the
  Skills screen, and `--method resources/directory/read` in the CLI. The
  client refuses the call locally when the server did not declare
  `directoryRead`, which is the SEP's MUST NOT. A child the directory lists
  but the entry does not is marked `not listed` rather than merged into the
  manifest — the SEP calls a directory result a live observation and forbids
  treating it as extending the manifest.

- CLI: `skills/list`, `skills/get` and `resources/directory/read`, plus
  `--verify` — one NDJSON report per skill, a summary on stderr, exit 7 on a
  violation. Reads are sequential; a conforming manifest may declare 512
  entries.

- TUI: a Skills pane, shown only when the server declares the extension. Each
  row carries its conformance verdict as a glyph as well as a colour, since
  the pane is read over ssh and through script(1). Enter verifies.

- `verifySkills` re-throws `AuthRecoveryRequiredError` rather than recording
  it per file: it says the session's authorization expired, so absorbing it
  would report N identical read failures and swallow the error the TUI and
  the web commands key off to reauthorize.

Two open questions settled, both in code comments where they will be found:
`skills/get` carries no caching attributes because SEP-2640 leaves the
question open in as many words, so requiring them would fail a conforming
server; and there is no `PagedSkillsState` because every consumer of this
list is a whole-catalog verdict — computed over page one of three, "this
server's skills conform" is not merely partial but wrong.

The fixture grows two skills, both for checks that were otherwise
undemonstrable: `lying-listing` (listing and file disagree, digest still
verifies) and `stale-manifest` (serves a file its manifest does not declare).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ND46Ci64DC3tzBy9aG81Nc
Signed-off-by: cliffhall <cliff@futurescale.com>

core/mcp/inspectorClient.ts

@@ -145,9 +145,14 @@ import {
 } from "./modernTaskSchemas.js";
 import { buildClientExtensions } from "./extensions.js";
 import {
+  DirectoryReadResultSchema,
   GetSkillResultSchema,
   ListSkillsResultSchema,
+  ModernDirectoryReadResultSchema,
   ModernListSkillsResultSchema,
+  RESOURCES_DIRECTORY_READ_METHOD,
+  SKILLS_EXTENSION_KEY,
+  type DirectoryReadResult,
   SKILLS_GET_METHOD,
   SKILLS_LIST_METHOD,
   type SkillEntry,
@@ -5648,6 +5653,77 @@ export class InspectorClient extends InspectorClientEventTarget {
     }
   }
 
+  /**
+   * One page of `resources/directory/read` (SEP-2640): the direct children of
+   * a directory resource.
+   *
+   * **Gated on the server's own declaration, and the gate throws rather than
+   * asks.** SEP-2640 is explicit that *"clients MUST NOT call
+   * `resources/directory/read` against a server that has not declared
+   * `directoryRead: true`"*, so this refuses locally instead of sending a call
+   * the spec forbids and letting the server answer `-32601`. Refusing here also
+   * keeps the Protocol tab honest: a request we were never allowed to make
+   * should not appear in the exchange log as a server-side failure.
+   *
+   * Not recursive — the SEP says clients descend by calling the method again on
+   * a child directory, so the walking is the caller's, not this method's.
+   */
+  async readResourceDirectory(
+    uri: string,
+    cursor?: string,
+    metadata?: RequestMetadata,
+  ): Promise<DirectoryReadResult> {
+    if (!this.client) {
+      throw new Error("Client is not connected");
+    }
+    const extension = this.getSkillsExtension();
+    if (!extension?.directoryRead) {
+      throw new Error(
+        `Server did not declare directoryRead in ${SKILLS_EXTENSION_KEY}; ${RESOURCES_DIRECTORY_READ_METHOD} must not be called.`,
+      );
+    }
+    const effectiveMeta = this.mergeMeta(metadata);
+    const params: Record<string, unknown> = {
+      uri,
+      ...(effectiveMeta ? { _meta: effectiveMeta } : {}),
+      // `!== undefined` for the same reason `listSkills` uses it: a cursor is
+      // opaque and `""` is a legal value, so truthiness would silently re-ask
+      // for page one.
+      ...(cursor !== undefined ? { cursor } : {}),
+    };
+    // Era-aware for the same reason `skills/list` is — the method is
+    // consumer-owned, so no SDK codec stamps or checks its envelope. The modern
+    // variant requires only `resultType`; see the schema for why it stops
+    // short of the caching attributes that `skills/list` requires.
+    const resultSchema = this.isModernEra()
+      ? ModernDirectoryReadResultSchema
+      : DirectoryReadResultSchema;
+    try {
+      return await this.invokeMcpClient(
+        () =>
+          this.client!.request(
+            { method: RESOURCES_DIRECTORY_READ_METHOD, params },
+            resultSchema,
+            this.getRequestOptions(this.progressTokenOf(metadata)),
+          ),
+        { method: RESOURCES_DIRECTORY_READ_METHOD },
+      );
+    } catch (err) {
+      // Same attribution `getSkill` does, and for the same reason: there is no
+      // managed store behind this method, so without this a rejected decode
+      // would render in the Protocol tab as a clean success while the caller
+      // showed an error. Only for a decode rejection — a request that never
+      // produced a response would otherwise stamp an earlier exchange.
+      if (isClientDecodeRejection(err)) {
+        this.markResponseRejected(
+          RESOURCES_DIRECTORY_READ_METHOD,
+          err instanceof Error ? err.message : String(err),
+        );
+      }
+      throw err;
+    }
+  }
+
   /**
    * Get a prompt by name
    * @param name Prompt name