feat: skills-first delivery, contract-trace directive, SPLUS.md (v0.9.2)

[ojowwalker77]

What

Skills-first delivery. The review protocol no longer depends on agents reading MCP tool descriptions. install.sh installs the skills into every detected agent — Claude Code (~/.claude/skills/splus-review, splus-prefs), Codex (~/.codex/prompts/splus-review.md), OpenCode (~/.config/opencode/command/splus-review.md) — canonical copy at ~/.splus/skills, refreshed on every splus update. Release tarballs now ship skills/.

Contract-trace review protocol (bench-proven on Martian cal.com PRs):

• review returns a deterministic CHANGED SYMBOLS block (engine exports ∩ diff hunks) via new changedExportedSymbols/diffText in @splus/shared
• the directive gains a TRACE CONTRACTS stage — return shape on every path → open every caller → report each mismatch (the most-missed real-bug class)
• anti-checklist clause — no generic hardening nits unless the diff introduces the flaw (the fix: address Splus self-review findings #1 false-positive source)
• same disciplines encoded in skills/review (new contract-drift lens)

SPLUS.md replaces splus.md as the per-repo contract (no fallback).

Bench pipeline (bench-only, MCP never calls it): second contract-tracing discovery lens with dedup; claude -p client fails closed on is_error/unparseable tool JSON; signal budget 3→4.

Hygiene: @splus/shared tests wired into pnpm -r test (package had no test script — splusMd.test.ts never ran in CI); dead @splus/triage dep dropped from @splus/mcp; all versions → 0.9.2.

Verification

• 25/25 unit tests, typecheck clean
• greenrun (full CI locally): PASS — ci/engine + ci/packages, all steps
• installer end-to-end in sandboxed HOME: install + all three agent wirings + update-refresh verified
• bundled mcp.cjs carries 0.9.2; engine reports 0.9.2

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}