fix(audit): audit-all partial-green (cli 22E→14E, project/apis/skills clean)

[ywatanabe1989]

Verdicts (auditor: scitex-dev, ecosystem audit-all scitex, exit 1 — partial green, expected)

• audit-project: 0 errors / 113 warnings / 1 info ✅ (error-clean)
• audit-python-apis: SUCC (801 files) ✅
• audit-skills: SUCC ✅
• audit-cli: 14 errors / 103 warnings ❌ (all 14 recorded below as skips)
• audit-mcp-tools / audit-django: no findings
• UNREADABLE tally: 1 ([defer] PS-103 root-whitelist note — auditor classifier can't classify its own defer line; scitex-dev bug, not a finding)

Fixed in this PR (cli 22→14)

• mcp list-tools/doctor/start/installation: §4 concrete examples in docstrings
• mcp start: genuine --dry-run (prints plan, binds nothing) + -y/--yes
• mcp installation → show-installation (§1 compound-leaf); old name kept as hidden compat alias (walker skips hidden); docs updated
• mcp show-installation: --json emits the raw Claude Desktop config
• New skills install (doctrine 03 §1e: symlink _skills/<pkg>/ → $SCITEX_DIR/dev/skills/<pkg>/, --claude-symlink, --dry-run, -y/--yes with real replace-gate semantics); --json on skills get; --dry-run/--yes on skills export; skills eager-loaded in main.py so the static walk sees it (was falsely reported missing)

Remaining 14 errors — skips with reasons (DO NOT fix per-repo)

#	Finding	Owner	Skip reason
1–2	main unregister-source/keygen §1d dict	peer main group (dag/chain/list-runs peer CLI)	peer vocabulary; blessing it in our dict or renaming peer commands needs peer-side coordination
3–5	event latest/history/types §1 noun-leaf	peer-adjacent (renames break UX)	rename to show-latest etc. is breaking; needs doctrine decision, not a drive-by
6–11	social delete/me/analytics, social mcp start/list-tools/installation §1/§2	socialia peer thin-wrapper (social.py header: thin wrapper around socialia CLI)	flags/renames must land in the peer CLI
12	social mcp installation §1	same peer wrapper	same as above
13–14	top-level install-shell-completion/print-shell-completion §1a	rule-vs-doctrine conflict	auditor demands legacy top-level leaves via attach_shell_completion; package doctrine §1b (CLI-standardization slice 5) deliberately retired that shape for the completion noun group. attach_ would also register a colliding completion alias + duplicate the owned group. Needs scitex-dev rule review (cf. playbook §8)

Warnings (rule-review, not per-repo fixes)

• cli 103W = 93× §4b (free-form help → CliHelp migration; fleet-wide rule review), 7× §1f verb synonyms (6 peer main + 1 peer social), 3× §13. NOTE: new §13 warns top-level skills should nest under dev, while §1a errors if top-level skills {list,get,install} is absent — auditor self-contradiction, kept the §1a-mandated shape.
• project 113W = 0 errors; dominated by structural PS-225 (extras design), PS-206b, PS-169/165/164 (org-shared CI), per playbook §8. +1 PS-145 vs baseline: skills install targets the doctrine-mandated ~/.scitex/dev/skills/ path (2 pre-existing PS-145 siblings); dest honors $SCITEX_DIR.

Tests

• pytest tests -q: 577 passed, 91 skipped, 44 xfailed, 17 xpassed, 0 failed (full suite, worktree venv).
• Pristine origin/develop (temp worktree, read-only): 576 passed, 0 failed → no pre-existing failures; branch introduces none.
• Flake note: one full-suite run showed test_every_standalone_writer_tool_is_reachable_via_umbrella failing (writer peer-mount timing); passes in isolation, on pristine, and on all subsequent full runs — ordering/load flake, not a regression.
• Env note: interpreter segfaults after the suite summary prints (tensorflow teardown; also on pristine) — results already recorded; pre-existing env issue.

Files (19, +974/−647)

Prior partial-run work + this session: cli/mcp.py, cli/skills.py, cli/main.py (eager skills), docs/sphinx/source/mcp.rst, plus carried-over audit fixes (logging migration, pyproject, lazy wiring, mcp registry, usage/helpers, tests). No scitex-dev or other packages touched.

DO NOT MERGE yet — partial-green PR for review; remaining 14 errors need peer-side or auditor-rule resolution.