feat: package Clerk skills for multi-agent distribution

[Railly]

Summary

This makes clerk/skills the single source of truth for Clerk's AI agent distribution across Agent Skills, Claude Code, Cursor, and Codex.

• flatten all validated Clerk skills into skills/<skill-name>/ with skills/clerk as the orchestrator/router
• add Claude, Cursor, and Codex plugin manifests that all consume the same flat skills/ bundle
• add Clerk MCP config for both Claude-style .mcp.json and Cursor-style mcp.json discovery
• add a Bun validator that guards the 20-skill bundle, manifest wiring, skill frontmatter, legacy nested paths, and MCP config
• document the compatibility strategy so future agents/commands/hooks only land after validated artifacts exist

Why

The scope expanded from a /.well-known/agent-skills endpoint into making the source repo itself distributable. That gives us one repo that can power:

• npx skills add clerk/skills retrocompat
• Claude Code plugin installs
• Cursor plugin installs
• Codex plugin installs
• future clerk.com/.well-known/* discovery generated from this repo

I compared the current Vercel and Stripe plugin repos before the latest adjustments:

• Vercel keeps a single-root plugin repo with flat skills/, plugin manifests, MCP config, and optional agents/commands/hooks.
• Stripe keeps canonical skills plus provider-specific copied plugin trees.
• For Clerk, the better fit is Vercel-style single-root distribution. We should not duplicate provider trees unless a provider requires it.

Platform coverage

Agent Skills

• keeps the public install flow working: npx skills add clerk/skills
• preserves all 20 validated skills, including the latest clerk-expo

Claude Code

• adds .claude-plugin/plugin.json for direct plugin loading
• adds .claude-plugin/marketplace.json for repo marketplace installs
• keeps skills at plugin root under skills/<skill-name>/SKILL.md
• adds .mcp.json for Clerk MCP discovery

Cursor

• adds .cursor-plugin/plugin.json at the repo root
• points Cursor at the shared skills/ directory instead of duplicating all skill paths
• adds root mcp.json with top-level mcpServers
• references the committed Clerk logo by relative path

Codex

• adds .codex-plugin/plugin.json
• adds .agents/plugins/marketplace.json
• points Codex at the same skills/ bundle

Out of scope

• no repo rename to clerk/ai yet; clerk/skills keeps the current install path stable
• no changes to clerk/clerk#2526 in this PR; that should follow by generating/serving well-known discovery from this repo
• no hooks, commands, agents, or provider-specific copied skill trees until we have validated artifacts to ship
• no direct changes to clerk/cursor-plugin; after this lands it can become a compatibility shim or deprecated repo

Verification

Local:

• bun run validate
• jq empty .agents/plugins/marketplace.json .claude-plugin/plugin.json .claude-plugin/marketplace.json .codex-plugin/plugin.json .cursor-plugin/plugin.json .mcp.json mcp.json package.json
• claude plugin validate .
• claude plugin validate .claude-plugin/plugin.json
• git diff --check
• find skills -mindepth 2 -maxdepth 2 -type f -name SKILL.md | wc -l => 20
• rg 'skills/(core|features|frameworks|mobile)' README.md AGENTS.md CLAUDE.md .cursor-plugin .claude-plugin .codex-plugin .agents/plugins skills => no matches
• npx -y skills add . --list => found 20 local skills
• npx -y skills add clerk/skills --list => current public install command still works and finds 20 skills
• temp project install: npx -y skills add /Users/raillyhugo/Clerk/skills --skill '*' --agent codex -y --copy => installed 20 skills
• MCP initialize against https://mcp.clerk.dev/mcp returned Clerk MCP Server capabilities for tools and resources

GitHub checks:

• CodeQL passed
• Analyze (javascript-typescript) passed
• Semgrep passed