feat(context): nan context ls|show|create|push|pull|edit|rm (agent contexts C1)

README.md

@@ -264,6 +264,32 @@ A platform token needs `notifications:read` to read and
 notifications on your account, these commands exit 64 and point at the
 portal. Docs: <https://nan.builders/docs/notifications>.
 
+### Agent contexts
+
+Keep instructions (`AGENTS.md`), skills (`skills/<name>/SKILL.md`) and
+reference files (`files/...`) on NaN as a versioned context for your runs and
+automations:
+
+```bash
+nan context ls [--json]
+nan context show <NAME|id> [--json]
+nan context create NAME [--description TEXT] [--from DIR] [--json]
+nan context push <NAME|id> DIR [--create] [--dry-run] [--force] [--allow-secrets] [--skip-invalid] [--allow-empty] [--json]
+nan context pull <NAME|id> DIR [--force]
+nan context edit <NAME|id> [--name NEW] [--description TEXT] [--json]
+nan context rm <NAME|id> [--yes]
+```
+
+`push` checks every file name before uploading anything (dotfiles are
+skipped; other refused names are listed with their reason and the push exits
+65 unless `--skip-invalid`), uploads only what NaN does not already hold
+(large files in resumable 16 MiB parts) and publishes a new version. Text
+that looks like a credential is refused unless `--allow-secrets`, and an
+empty folder never empties a context unless `--allow-empty`. `pull`
+writes into an empty folder only, after checking every path with the same
+rules. Without contexts on your account, these commands exit 64 and point at
+the portal. Docs: <https://nan.builders/docs/contexts>.
+
 ### Exit codes
 
 `nan run`, `nan runs logs -f` and `nan automations run` exit with the run's outcome, so a script can