fix(skills,cli): close four reproduced contract gaps from the CLI feedback digest (#2476)

* fix(cli): invalidate the skills nudge cache after a successful install/update/check

The passive "N skills out of date or missing" nudge reads a 24h config
cache that only the background check (on non-skills commands) ever wrote.
The skills commands themselves are excluded from the nudge pipeline, so a
successful `skills update`/install/check never refreshed or dropped the
cached verdict — the pre-install count kept printing on every other
command for up to 24h.

Reconcile commands now drop the cached verdict (counts + timestamp) so
the next command's background check re-runs for real. The offline
presence-only path deliberately keeps the cache: that run learned nothing
about freshness.

* fix(skills): win32-safe npx spawns in media-use + accurate whisper wording

The Whisper transcribe fallback and the Kokoro local-TTS delegation both
spawned a bare "npx" via execFileSync — on Windows npx is npx.cmd, which
spawn cannot exec, so both paths died with `spawnSync npx ENOENT`. Route
them through the skill's existing resolveSpawnCommand (node + npx-cli.js
on win32, no shell:true), same as the audio engine's TTS spawns.

Also corrects the "bundled with the hyperframes CLI" claim about
whisper.cpp: it is resolved from PATH / installed via Homebrew / built
from source with git+cmake on first use, and models download from
HuggingFace — nothing whisper is shipped in the package.

* feat(skills): canonical fully-silent marker + auth status exit-code docs

product-launch's Step 3.1 gate said "or the project is marked silent"
but nothing defined how to mark one, and audio.mjs unconditionally
retrieved BGM. Define the canonical marker — `music: none` in the
storyboard's top YAML block, plus no SCRIPT.md — and honor it:
audio generate produces nothing (removing stale audio_meta.json, since
absence is what assemble treats as silent), and `music: none` with
narration keeps TTS while turning BGM off.

Also documents the `auth status` exit-code contract (exit 1 while
signed out is the normal offline state, not a failure) in the
product-launch Step 0 note and the CLI skill's cloud reference.

* fix(skills): transient-init retry for standalone animation-map and contrast-report

The standalone helpers called initializeSession exactly once, so a valid
modular project — whose sub-composition timelines register asynchronously
— could hit the readiness deadline and die with the transient
"zero duration / Runtime ready: false" diagnostic the render pipeline
retries (probeStage). Add initializeSessionWithRetry to the shared
package-loader (both byte-identical copies): close the crashed session
and retry once with a fresh browser, gated by the engine's canonical
isTransientBrowserError — now re-exported from @hyperframes/producer,
with a frozen fallback pattern list for older published packages. The
"Runtime ready: true" fast-fail (a genuine authoring bug) still fails
without a retry.

* feat(skills): extend the fully-silent marker to faceless-explainer and pr-to-video

Both workflows reuse product-launch's audio model — their Step 3.1 gates
carried the same undefined "marked silent" phrase, and their (intentionally
identical) audio.mjs copies had the same unconditional BGM retrieve. Port
the `music: none` marker handling into both copies, define the marker in
their SKILL.md Step 3.1 and story-design references, and turn the
copies' "intentionally identical" header claim into a byte-identity pin
test so the next fix can't silently miss one of them.

* test(cli): reset the prune mock explicitly instead of relying on restoreAllMocks

The converge test's toHaveBeenCalledTimes(1) held only because vitest 3's
vi.restoreAllMocks() clears vi.fn() call state; vitest 4 restores spies
only, so the count would accumulate across tests and fail. Reset
pruneOrphanedLockEntries in beforeEach like the other manifest mocks —
passes under both vitest 3.2.4 (pinned) and vitest 4.

* test(skills): close review findings — package-loader pin, whisper win32 parity, quoted-none

Review follow-ups on #2476:

- package-loader.mjs byte-identity pin (the elevated concern): the two
  copies now carry initializeSessionWithRetry + FALLBACK_TRANSIENT_PATTERNS,
  exactly the shared-logic shape a future fix could land in one copy and
  miss in the other — same enforcement as the audio.mjs pin.
- whisper win32 call-site parity: runWhisper's npx resolution lifted into
  lib/npx-sync.mjs (resolveNpxInvocation, injectable params matching the
  localTtsGenerate idiom) with the same three-branch coverage as the
  Kokoro site — plus the hard-fail contract (throws actionably, since the
  whisper fallback has no next provider to fall through to).
- quoted music: "none" pin: the vendored storyboard parser strips matching
  quotes at parse time (stripQuotes), so the silent marker already accepts
  the quoted spelling — pinned so that stays true.

packages/cli/src/utils/skillsUpdateCheck.test.ts

@@ -11,6 +11,7 @@ let config: FakeConfig;
 
 vi.mock("../telemetry/config.js", () => ({
   readConfig: () => ({ ...config }),
+  readConfigFresh: () => ({ ...config }),
   writeConfig: (next: FakeConfig) => {
     config = { ...next };
   },
@@ -108,4 +109,71 @@ describe("skillsUpdateCheck", () => {
     });
     expect(text).toContain("1 HyperFrames skill out of date or missing");
   });
+
+  // Regression: the stale-24h-cache bug. A successful `skills update`/install
+  // never wrote the cache, and the skills commands are excluded from the nudge
+  // pipeline entirely — so the pre-install "20 out of date or missing" verdict
+  // kept printing on every other command until the TTL expired.
+  // invalidateSkillsCache() is the fix: reconcile commands drop the cached
+  // verdict so the next command re-checks for real.
+  describe("invalidateSkillsCache", () => {
+    const PRE_INSTALL_CACHE = {
+      lastSkillsCheck: new Date().toISOString(), // fresh — inside the 24h TTL
+      skillsUpdateAvailable: true,
+      skillsOutdatedCount: 12,
+      skillsMissingCount: 8,
+      skillsRemovedCount: 0,
+    };
+
+    it("a fresh cache short-circuits the background check with the stale verdict (the bug's precondition)", async () => {
+      config = { ...PRE_INSTALL_CACHE };
+      const { checkSkillsForUpdate } = await import("./skillsUpdateCheck.js");
+
+      const meta = await checkSkillsForUpdate();
+
+      expect(mockCheckSkills).not.toHaveBeenCalled();
+      expect(meta).toEqual({ updateAvailable: true, outdated: 12, missing: 8, removed: 0 });
+    });
+
+    it("drops the cached verdict so the next background check re-runs for real", async () => {
+      config = { ...PRE_INSTALL_CACHE };
+      mockCheckSkills.mockResolvedValue({
+        location: "/home/user/.claude/skills",
+        updateAvailable: false,
+        summary: { current: 20, outdated: 0, missing: 0, coreMissing: 0, removed: 0 },
+      });
+
+      const { checkSkillsForUpdate, invalidateSkillsCache } =
+        await import("./skillsUpdateCheck.js");
+      invalidateSkillsCache();
+
+      // All five cached fields are gone — timestamp AND counts.
+      expect(config["lastSkillsCheck"]).toBeUndefined();
+      expect(config["skillsUpdateAvailable"]).toBeUndefined();
+      expect(config["skillsOutdatedCount"]).toBeUndefined();
+      expect(config["skillsMissingCount"]).toBeUndefined();
+      expect(config["skillsRemovedCount"]).toBeUndefined();
+
+      const meta = await checkSkillsForUpdate();
+      expect(mockCheckSkills).toHaveBeenCalledWith({ canonical: true });
+      expect(meta).toEqual({ updateAvailable: false, outdated: 0, missing: 0, removed: 0 });
+    });
+
+    it("counts are cleared, not just the timestamp — an offline machine goes quiet instead of resurrecting stale counts", async () => {
+      config = { ...PRE_INSTALL_CACHE };
+      mockCheckSkills.mockRejectedValue(new Error("offline"));
+
+      const { checkSkillsForUpdate, invalidateSkillsCache, printSkillsUpdateNotice } =
+        await import("./skillsUpdateCheck.js");
+      invalidateSkillsCache();
+
+      // Refresh fails (offline) → falls back to cached meta, which is now empty.
+      const meta = await checkSkillsForUpdate();
+      expect(meta).toEqual({ updateAvailable: false, outdated: 0, missing: 0, removed: 0 });
+
+      const writeSpy = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+      printSkillsUpdateNotice();
+      expect(writeSpy).not.toHaveBeenCalled();
+    });
+  });
 });