fix(cli): reconcile W9 against the merged sdk store surface

[espetro]

Summary

W8 (sdk) and W9 (cli) were implemented in parallel against the pre-merge API sketch; when #73 landed with the canonical store surface, the cli drifted. This PR reconciles the cli to the sdk as shipped, so harness works end-to-end on merged v2 — the first PR where the whole stack is real (no stubs anywhere in the path).

Closes the wave-2 reconciliation item in .agents/plans/2026-10-07-v2-foundation.md.

Changes

• api.ts → type-only re-export hub of the sdk surface (Store, ports, wire types) + cli-local bridge constants. Re-exports are erased at build → drift is impossible by construction.
• ports/fs.ts rewritten to sdk's FsPort: byte-oriented readFile/writeFile/appendFile, .code-carrying errors (ENOENT→not-found, EEXIST→exists, …), stat→null on missing, createExclusive via O_EXCL, readlink + ln-backed symlink (island rule).
• ports/exec.ts rewritten to run(command, args, opts) → {code, stdout, stderr} over execFile only (no shell).
• root.ts: resolves the agents root (~/.agents), not the harness dir — the sdk owns harness/ beneath it. (Was causing doubled harness/harness/ paths at runtime.)
• cli.ts: createStore(root, ports, { actor, approveExec }) — TTY sessions get a y/N prompt per exec class.
• commands: add maps --skill-target→installTarget + adds --update; list forwards kinds/enabledOnly; audit reads store.auditLog(); serve reads harness/config.toml under the store root.
• errors.ts: toCliError forwards StoreError.kind/data structurally — a trust-violation or manifest-invalid (with issues) now surfaces as such instead of internal.
• testing layer rewritten to canonical shapes: in-memory FsPort (bytes, dirents, createExclusive) + a full-surface mock Store (list/get/install/remove/setEnabled/materialize/verify/doctor/policy/auditLog/subscribe/readLock).
• sdk: removed the declare global block in ports.ts (collides with @types/node at TS2300 in consumers); globals now come from lib: ["DOM","DOM.Iterable"] in tsconfig.
• tsdown.config.ts: deps.alwaysBundle: ["@any-harness/sdk"] — dist/cli.js must run standalone for scriptc packaging; neverBundle doesn't override dependency auto-externalization.

Test plan

• pnpm -r test — 121/121 pass (spec 1, metaharness 4, sdk 59, cli 57)
• pnpm -r typecheck clean
• E2E smoke on real binary: add local: → list → verify → disable/enable → audit → doctor → remove on a fresh ANYHARNESS_HOME
• serve over stdio: capabilities.negotiate handshake → session → capability-gated extensions.list; error envelopes verified (-32602/-32001/-32002/-32601)

Notes

• One behavioral fix surfaced during smoke: negotiating clients that declare no kinds see an empty extensions.list — that's spec-correct (capability gating), worth knowing for claurst's client PoC.
• CF Pages check fails on every v2 PR (it builds the deleted v1 docs/ site) — environmental, same as feat(spec): bridge protocol v0.1 — ops, capabilities, transports, security #68–feat(sdk): store + sources + lockfile + trust + bridge ops #73.

Link to Devin session: https://app.devin.ai/sessions/b930ce55fa0b489c98bc27f0b9a3927c
Open in Devin Desktop: https://app.devin.ai/desktop/session/b930ce55fa0b489c98bc27f0b9a3927c?variant=devin
Requested by: @espetro

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[cursor]

Approved. Cursor Bugbot was not present after the first check poll, so that automated-review signal was skipped. No applicable approval policy or remaining configured signal requires human review on the current head.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}