[tms-anhnguyen1]

Stacked on #24 (fix/upstream-support-files); review that first. Retarget to main once it merges.

Why

The suite never measured coverage, and cli.ts (flags, human and --json output, every exit code the usage text promises) had no test at all, because it ran itself on import.

Change

• cli.ts exports main(argv, io). src/bin.ts is the process boundary: argv in, exit code out. The build entry moves to it, and dist/ keeps its shebang and behaviour.
• vitest.config.ts holds src/ at 100% statements, branches, functions and lines. npm run check now runs npm run coverage in place of npm test. @vitest/coverage-v8 is a devDependency, and coverage/ is ignored.
• Branches no input can reach are removed, not excluded:
  • fallbacks the types already rule out (?? 'unknown', ?? left, if (!tech) continue, ?? 'not approved', cells[index] ?? '', a .catch on a directory known to exist);
  • the unused copyTarget;
  • a double agentsMd check;
  • declined, which was remapped under --json, where the checklist never runs. The --json shape is unchanged.
• AGENTS.md records the gate and the remove-don't-exclude rule.

Tests

File	Covers
tests/cli.test.ts	every flag, catalog, resolve, generate, check; exit codes 0/2/3/64/65/130; the checklist on a fake terminal
tests/cli-errors.test.ts	a failure thrown that is not an Error (exit 1)
tests/catalog.test.ts	invalid catalog.yaml and upstream.yaml, duplicate ids, self-conflict, a content dir that is a file, symlinks
tests/emit.test.ts	an unreadable manifest, a manifest that predates fields, a link inside a skill dir, a missing source

Additions to prompt, resolver, table and validator. fakeTty moves to tests/fake-tty.ts.

Scope

scripts/*.mjs stays outside the gate: they are dev tools, and sync needs git and the network. Their pure helpers are tested.

Verification

npm run check: 189 tests, 100% on all four metrics (877/877 statements, 455/455 branches). The bundled CLI was smoke-tested with generate, check and a usage error.