Fix agent skill packaging and CLI guidance

[keydunov]

Summary

• make all nine skill descriptions valid strict YAML and harden the local validator against unquoted : values
• fix the Claude marketplace manifest so it validates and installs
• correct Cube CLI command signatures across deployment, administration, embedding, model, and content workflows
• distinguish read-only content inspection commands from dashboard/thread mutation commands
• document the completed smoke-test coverage and remaining write-path gap

Why

Pre-release smoke testing found that strict YAML parsing caused npx skills add to discover only four of nine skills. It also exposed several examples whose arguments did not match Cube CLI 1.7.21, plus two workbook commands classified as reads even though they mutate state.

Validation

• python3 scripts/validate-skills.py — 9 skills, 0 warnings
• both plugin manifests parse as JSON
• Claude Code 2.1.234 marketplace validation and isolated plugin install — 9 skills
• skills@1.5.22 clean Codex install and discovery — 9 skills
• all 103 referenced Cube command paths resolve in Cube CLI 1.7.21
• read-only smoke test against d3-demo deployment 75, including compiled metadata, saved content, agents, administration, deployment state, embed eligibility, and a real aggregate query
• natural-language Codex request implicitly selected cube-explore-model

Remaining coverage

Mutating model, content, agent, access, embed, and deployment workflows were intentionally not executed against the shared d3-demo tenant. They still need a disposable-tenant pass before those write paths are considered fully verified.