fix: make bare skills command agent-first

[andrei-hasna]

Summary

• make bare skills print Commander command discovery and exit 0 in TTY and non-TTY contexts while keeping skills interactive / i explicit
• define the canonical local / selfhost / optional cloud target contract without presenting target behavior as current implementation
• set the unreleased breaking pre-1.0 candidate to 0.2.0; npm remains at 0.1.58, with no publish or tag in this PR
• keep generic auth, API-key, tenant-isolation, observability, and provider-neutral selfhost deployment contracts in OSS; keep only Hasna SaaS-specific account/org/billing/managed-ops/private configuration in platform
• define trust-first cloud onboarding through signed metadata, OIDC browser/device auth with PKCE/state/nonce, signed tenant selectors and challenges before product API credential issuance, replay protection, recovery, and re-enrollment
• define storage selection precedence as explicit selector, named-profile sources, legacy bridge only when no named storage profile is selected, then built-in local
• label the proposed HASNA_SKILLS_SERVER_* compatibility namespace as target architecture and keep current-source blocker claims limited to environment names the server actually reads
• reject empty and malformed ambient custom skill directories during both registry discovery and direct lookup, while preserving valid custom skills and explicit --allow-shadow import policy
• exclude dist/cli/cli.test-utils.d.ts from the npm package while retaining public declarations
• require task worktrees for upstream sync and keep strict private-marker checking enabled

Current implementation blockers

• current shared client/server reads are limited to HASNA_SKILLS_DATABASE_URL, HASNA_SKILLS_S3_BUCKET, and HASNA_SKILLS_S3_PREFIX plus documented plain-name fallbacks
• database pool configuration is server-only; current server source does not read client S3 endpoint, path-style, or package credential settings; the artifact client independently reads unscoped AWS_REGION
• the proposed HASNA_SKILLS_SERVER_DATABASE_*, HASNA_SKILLS_SERVER_S3_*, and HASNA_SKILLS_SERVER_AWS_REGION names and dual-read rules are target compatibility design, not current reads
• .github/workflows/deploy.yml still contains Hasna-specific AWS production configuration and automatic main deployment; that internal AWS deployment is selfhost, not cloud
• this PR intentionally does not edit/delete the deploy workflow, release guard, or secrets checker and does not publish, tag, merge, or deploy

Verification

• final ambient-HOME bun test: 754 pass, 0 fail, 10,034 expectations across 64 files
• final clean-HOME bun test: 754 pass, 0 fail, 10,029 expectations across 64 files
• focused custom-discovery/direct-lookup/skillinfo/bulk-import regressions: 98 pass, 0 fail
• bun run typecheck
• bun run build
• bun run verify:release: 1,362 package-visible files passed
• bun pm pack and bun pm pack --dry-run --quiet: package contains public declaration surfaces and excludes dist/cli/cli.test-utils.d.ts
• scripts/check_skill_corpus_drift.sh --base HEAD: 248 directories / 248 registry skills, no drift
• strict upstream checker passed for the outgoing commit range across 10 changed files
• git diff --check and staged whitespace check passed
• Gitleaks staged and outgoing commit-range scans passed with full redaction
• adversarial self-review found the legacy custom-directory variant; a regression and matching validation were added, then all final gates reran green