feat: agent CLI transport, resilient MCP bridge, proactive Skill (0.2.0)

[liyangbing]

Summary

Make agents reliably get results from SandBase after install (parity with Monid's post-install experience).

• Skill: removed disable-model-invocation: true (it stopped Codex/Cursor from auto-loading the Skill); proactive trigger description; MCP-first with CLI fallback; cost, error, and polling rules.
• Agent CLI commands: discover / inspect / run / runs get / runs list / balance / keys, reusing connect credentials. -j JSON, -o writes output to disk, -w polls with backoff. A started run always keeps its run_id in errors; -o is validated before any paid call.
• MCP bridge: falls back from api.sandbase.ai to www.sandbase.ai (6h preference cache); answers initialize/tools/list locally when offline or on 5xx so the client keeps the server; tool failures become isError results with a next step. sandbase_run is never replayed after it may have been sent (no double billing); no hard timeout on tool calls.
• doctor / setup: doctor makes a real round trip (initialize → tools/list → account); new setup refreshes the bridge and SandBase-owned Skills (user-edited Skills untouched).
• Update notice: daily npm check, surfaced in stderr and JSON notes.
• Version 0.2.0. Compatible with the current server; the apiserver PR adds run_get output and structured tool errors, which the CLI uses when present.

Tested

• npm run lint, npm test (172 tests, 171 pass, 1 pre-existing skip), npm run audit:package.
• Live against production with free calls: discover, inspect ($ref schema resolved), balance, runs list, doctor probe, bridge fallback (first session ~14s via mirror, later ~2s), unknown-tool isError hint.
• Not tested live: paid run/runs get -w end-to-end (covered by fake-server tests).

Not included

• No release/tag; publishing 0.2.0 to npm is a separate step.