verify: NPX skills bootstrap from clean env

[DecisionNerd]

Objective

Prove the public agent-skills package can bootstrap from a clean environment.

Acceptance criteria

1. A clean environment executes @curatelabs/graphforge-agent-skills@0.5.0 from public npm without a repository checkout.
2. The documented bootstrap scenario completes and validates its generated/returned contract.
3. Evidence records Node/npm versions, command, resolved package version, and outcome.

Relationships

• Parent: post-release: v0.5.0 clean-env verification and follow-up #167
• Blocked by: release: publish v0.5.1 Node binding, CLI, and skills #198 and release: publish v0.5.1 documentation #197

[DecisionNerd]

Evidence path (blocked until publish)

Lane: skills in the CurateLabs/graphforge-legecy#2795 harness (PR CurateLabs/graphforge-legecy#2822).

• Docs/map: docs/development/clean-environment-verification.md
• Local: python3 scripts/ci/clean-env-verify.py run --version 0.5.0 --lane skills ...
• CI: workflow_dispatch Clean Environment Verify after public registries have 0.5.0

Blocked on #198 (via CurateLabs/graphforge-legecy#2794). Preflight today fails closed — registries do not yet publish 0.5.0. Do not check off without real install/URL/checksum evidence.

[DecisionNerd]

Clean-env evidence (skills) — PASS

Version disposition: Issue titles name v0.5.0. Public registries show v0.5.0 as an incomplete surface (PyPI + @curatelabs/graphforge only; no CLI/skills/crates). The first complete coordinated surface is v0.5.1, and the current public release is v0.5.2. Clean-env verification was executed against 0.5.2 from public registries (not local RC artifacts), matching the intent of post-release proof after #192/#194–#198 closed.

Note: @curatelabs/graphforge-agent-skills@0.5.0 was never published (404). First skills publish is 0.5.1; verified 0.5.2.

AC mapping

1. Clean env installed @curatelabs/graphforge-agent-skills@0.5.2 from public npm (no repo checkout).
2. Bootstrap/compatibility contract validated via npx --offline --no-install graphforge-agent-skills compatibility --json (schema_version 1, package_version 0.5.2, graphforge_release 0.5.2).
3. Evidence recorded below.

Environment: macOS-26.6 arm64; Python 3.14.6; Node v24.16.0; npm 11.13.0
Harness: python3 scripts/ci/clean-env-verify.py run --version 0.5.2 ...
Evidence: build/clean-env-evidence-0.5.2.json schema graphforge-clean-env-evidence-v1, overall ok: true, generated_at 2026-08-07T15:45:02+00:00, sha256 75bdc396388b8d47787e64f584df3f73fcf2203be9bab605303801a78aa3f6a2
Release record: GitHub Release asset v0.5.2-digest.json (graphforge-release-candidate-v2, commit c2b782cd833d54aa14bb097b69bd23f3c2a93a9b), sha256 9dc019016e3cf0d8f456638f3e87d45b3de3fab5d252c9218efcd04f9d0e1aaf
PRs: URL-lane harness #429