chore: address Copilot review round 4

- verify:skills:cli — the authoritative validator is now a GUARANTEED step in
  `local:gate` and CI, not a best-effort hand-off. It resolves the CLI itself
  (an installed one at 2.1.233+, else a pinned `npx -y`), so both tiers run the
  same script and cannot drift. `verify:skills` keeps skipping when the CLI is
  absent, which is right for `validate`: fast, offline, no Claude Code required.
- skill-manifest: the 1,536-char listing-entry cap covers `description` +
  `when_to_use` together; checking the description alone passed an over-cap
  entry. `when_to_use` is now parsed, validated and counted, with boundary tests
  at 1,536/1,537.
- verify-skills: report the budget as *this repo's contribution*. The real
  listing budget is shared with bundled skills and the contributor's own
  ~/.claude/skills, none of which is visible from here, so the number was
  claiming more than it measured.
- skill-eval: a negative case now means "no skill OF THIS REPO'S fired". It
  failed on any Skill invocation, so a contributor with an unrelated global
  skill got a false failure about their environment rather than these skills.
- docs/architecture + local-dev: the Node backend runner gets its
  `@inspector/core` alias from `clients/web/tsup.runner.config.ts`, not from
  Vite. The old text sent runner work to the wrong config.
- local-dev: the tarball does not ship "only each client's build/" — the
  allowlist also carries `clients/web/dist`, `clients/web/static` and the
  install helper. States the invariant that actually matters instead.
- issue-triage: the test for needing triage is "no board card". Adding "and no
  milestone" would skip the approved-but-unboarded case the same section then
  handles. Also corrected the `$M` note: the lookup is `--state all`, so closed
  issues DO have entries — `isopen` is about the invariants, not the lookup.
- issue-create: replaced "all five" with a per-version table. Steps 3 and 6
  (milestone, Priority) do not exist for v1, so the old list opened with a rule
  the same skill later tells you to violate.

Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/verify-skills-cli.test.mjs

@@ -0,0 +1,52 @@
+// Tests for the authoritative-validator step's CLI resolution (#2163, Copilot).
+//
+// The point of the step is that it does NOT skip: `verify:skills` treats a
+// missing CLI as a skip, and "skips when absent" plus "usually absent" adds up
+// to "never runs", which is what made the acceptance criterion aspirational.
+// So the branch that matters is the one that falls back to a pinned `npx`
+// rather than giving up — and on a machine with a current CLI installed, that
+// branch is never taken by an actual run.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { validatorCommand } from "./verify-skills-cli.mjs";
+import {
+  PINNED_CLI_VERSION,
+  PLUGIN_VALIDATE_MIN_VERSION,
+} from "./lib/skill-manifest.mjs";
+
+test("uses an installed CLI that has the subcommand", () => {
+  const cmd = validatorCommand({ version: [2, 1, 250] });
+  assert.equal(cmd.command, "claude");
+  assert.deepEqual(cmd.args, ["plugin", "validate", ".claude/skills"]);
+  assert.match(cmd.via, /local claude 2\.1\.250/);
+});
+
+test("uses the installed CLI exactly at the floor", () => {
+  assert.equal(
+    validatorCommand({ version: PLUGIN_VALIDATE_MIN_VERSION }).command,
+    "claude",
+  );
+});
+
+test("falls back to a pinned npx when no CLI is present", () => {
+  const cmd = validatorCommand({ version: null });
+  assert.equal(cmd.command, "npx");
+  assert.deepEqual(cmd.args, [
+    "-y",
+    `@anthropic-ai/claude-code@${PINNED_CLI_VERSION}`,
+    "plugin",
+    "validate",
+    ".claude/skills",
+  ]);
+  assert.match(cmd.via, /no local CLI/);
+});
+
+test("falls back when the installed CLI predates the subcommand", () => {
+  // An older binary answers `--version` fine and then exits nonzero on
+  // `plugin validate` as an unknown command, so running it would fail the gate
+  // for someone whose only sin is not having upgraded.
+  const cmd = validatorCommand({ version: [2, 1, 232] });
+  assert.equal(cmd.command, "npx");
+  assert.match(cmd.via, /predates the subcommand/);
+});