feat(cli): local folder skill registries

[codeaholicguy]

Summary

• add explicit local-folder registry sources stored as canonical absolute file: URLs while preserving the existing string-map config
• accept absolute, ./, and ../ CLI inputs; resolve template/config-relative paths against their containing file
• read local registries in place across preparation, install, indexing, update, removal, and status
• refresh local search entries independently of remote seed/index TTL and remove focused index entries on unregister
• document move/re-add semantics and phase-1 Windows/UNC exclusions

Safety rules

• local registry folders are read-only: no clone, pull, checkout, clean, copy-into, write, or delete
• local sources never fall back to a same-ID cache and stale same-ID caches are excluded from update
• removal derives deletion targets only from validated registry IDs beneath SKILL_CACHE_DIR
• source type is explicit (file: vs existing Git strings), never inferred from filesystem existence
• canonical paths prevent duplicate folder registration
• skill and SKILL.md realpaths must stay inside the registry; escaping symlinks are rejected
• discovery is direct-only and bounded to 10,000 entries / 1 MiB metadata files
• missing, moved, empty, malformed, and hosted-file sources return contextual errors

Validation

• npm run build — 6 projects passed
• npm test — 2,188 tests passed across 6 projects (1,140 CLI)
• npm run lint — passed, 0 errors; 2 pre-existing unrelated warnings
• npm run test:e2e — 42 tests passed
• npx ai-devkit@latest lint --feature local-registry — passed

Coverage note: the repository npm run test:coverage command exits successfully, but Nx forwards --coverage as an npm config option, so Vitest does not emit a trustworthy coverage report. Focused TDD suites and the full test suite are green.

Lifecycle docs

Requirements, design, planning, implementation, and testing records are under docs/ai/*/2026-09-07-feature-local-registry.md.