feat(cli): ship the skills — build copies them, plur init installs them (#1190)

[plur9]

The problem

skills/plur-create-engrams/ has been maintained and version-stamped by
release.sh on every release while shipping to nobody. Two gaps, each
invisible on its own:

• packages/cli/package.json declares files: ["dist"], and skills/ lives at
  the repo root. files[] is package-relative, so no manifest entry could
  ever reach it — adding "skills" there ships nothing at all.
• plur init had no skill-installation leg. Its single Skill reference is
  a PreToolUse matcher that fires when a skill is invoked — a different
  thing, and one that reads as coverage at a glance.

So npm install -g @plur-ai/cli delivered no engram-authoring guidance, while
the per-release version bump made it look shipped. Engram quality degraded
accordingly: the guidance on what earns a place in memory, and how to write a
statement, rationale and boundary that still hold months later, was not present
while engrams were being written.

The fix

Packaging — scripts/copy-skills.mjs copies the tree into dist/skills
after tsup. It must run after, because the first tsup config sets clean: true
and would wipe a copy made earlier. files: ["dist"] already covers dist/, so
no manifest change is needed. The whole tree travels, including
references/, which SKILL.md instructs the agent to read before serialising —
the part that actually carries the format.

Install — installSkills() writes to skills/ beside the settings.json
init is already writing, so it inherits init's existing scope decision:
--global → ~/.claude/skills/, project mode → ./.claude/skills/. No new
flag, one place decides scope. Idempotent; contained via containLeg like the
harness legs, so an unwritable directory cannot abort the hooks and MCP
registration that are the point of plur init; and it reports overwriting a
locally-changed skill rather than clobbering in silence.

Verification

• npm pack --dry-run lists all 8 files under dist/skills/
• sandbox plur init: lands the full tree; re-run reports already current;
  after a local edit reports overwrote locally-changed plur-memory
• test/init-skills.test.ts (7 tests) holds both halves — confirmed they fail
  if the fix is removed: hiding dist/skills fails 3
• @plur-ai/cli: 64 files / 700 passed / 0 failed
• full workspace suite on a quiet machine: 381 files passed, 0 failed

CHANGELOG

Declares ## 0.20.0, headed by this fix. Provenance is demoted from headline to
a section and marked experimental and off by default — record generation
defaults to never, the flags are opt-in, plur_provenance is behind
plur_admin, and the profile is 0.9 draft and OPTIONAL. Its two non-dormant
behaviour changes are called out: plur packs export now refuses without a
licence, and credentials in attribution/rationale/source are refused at
write time even at local scope.

All 59 user-facing PRs since v0.19.4 are declared, so the release manifest
gate (Step 3.6) passes.

Closes #1190

🤖 Generated with Claude Code

https://claude.ai/code/session_01S4or5TZEfYoreFm7GLJwRJ