fix(skills): require ttlMs and cacheScope on modern skills/get results

[cliffhall]

Closes #2404

What

The stable ext-skills spec settles the question SEP-2640 left open: GetSkillResult extends CacheableResult, so ttlMs and cacheScope are REQUIRED on skills/get, as they are on resources/read. Before this change the Inspector accepted a modern skills/get result without them, so a non-conforming server was reported as clean.

Changes

• core/mcp/skillsSchemas.ts adds ModernGetSkillEnvelopeSchema: the { skill } envelope plus ttlMs (non-negative integer) and cacheScope (public | private). These are the same field shapes as ModernListSkillsResultSchema. The legacy GetSkillEnvelopeSchema stays permissive. I rewrote the "left open" / "not era-aware, settled" comments, including the module-level note on why only resources/directory/read has no modern variant.
• core/mcp/inspectorClient.ts: getSkillResult now picks its schema from the negotiated era, the same way listSkills does. The SDK codec checks and lifts resultType (Inspector never declares the skills extension in its client capabilities #2373) but never checks the caching attributes of a consumer-owned method, so this schema is the only thing that validates them. When a modern result is rejected, it is still attributed to its Protocol entry through the existing decode-rejection path.
• Tests
  • Schema unit tests: legacy accepts the fields whether present or absent; modern requires both, rejects ttlMs of -1 or 0.5, rejects an unknown cacheScope, and still requires the envelope.
  • Client unit tests: a modern result without the fields is rejected; a conforming one resolves; getSkillResult returns the fields whole.
  • A new integration case runs on both eras against the skills fixture, which already stamps the fields.
• docs/inspector-roadmap-2026-h2.md: the two notes that listed this as an open gap now describe it as closed.

The skills fixture server already sends ttlMs: 0, cacheScope: "public" on skills/get, so the modern integration leg passes unchanged.

No UI change, so no screenshots.

npm run local:gate is green.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation matches the specification and issue requirements with comprehensive era-aware coverage.

Review effort: Balanced
Findings: None

What changed in this PR

Enforces stable ext-skills cache metadata requirements for modern skills/get responses while preserving legacy compatibility.

Changes:

• Adds era-aware skills/get result validation.
• Covers schema, client, and real-transport behavior.
• Updates roadmap documentation to close the validation gap.

File	Description
core/​mcp/​skillsSchemas.ts	Adds the modern cacheable envelope schema.
core/​mcp/​inspectorClient.ts	Selects the schema by negotiated era.
clients/​web/​src/​test/​core/​mcp/​skillsSchemas.test.ts	Tests modern and legacy schema rules.
clients/​web/​src/​test/​core/​mcp/​inspectorClient-skills.test.ts	Tests client validation and returned metadata.
clients/​web/​src/​test/​integration/​mcp/​inspectorClient-skills.test.ts	Verifies cache fields over real transports.
docs/​inspector-roadmap-2026-h2.md	Marks the validation gap as resolved.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[cliffhall]

Copilot review loop closed: round 1 came back clean ("Findings: None", no inline comments, no suppressed block), so I'm stopping on the first clean round per pr-flow step 7c.