chore(repo): restore deleted skills, package plugin, and align MCP server

[theonly1me]

What changed

• Restore .claude/skills/{clean-code,data-handling,scoped-fix}/SKILL.md inadvertently dropped during earlier quickstart changes.
• Include .claude-plugin in package.json files distribution.
• Repoint .claude-plugin/hooks/hooks.json command paths to ${CLAUDE_PLUGIN_ROOT}/dist/shadowclone.js.
• Sync .claude-plugin/plugin.json and MCP serverInfo versions with package.json.
• Point .mcp.json at ./src/mcp/server.ts so project-level MCP connections succeed without plugin environment variables.
• Expose shadowclone mcp in CLI command router.

Why

Documented conventions and contributing workflows depend on repository skills that were accidentally removed. Packaging the plugin and pointing hook invocations at compiled artifacts ensures npm installs can execute session hooks without requiring a full repository checkout. Pointing project MCP configuration to repository paths prevents connection failures when run outside plugin loaders.

How to verify

bun run build
bun run check
bun run dist/shadowclone.js --version
echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}' | bun run ./src/mcp/server.ts

Data handling

• Any new capture source has an opt-in flag and a README entry in this PR
• Everything that reaches the network passes redactSecrets
• No raw capture in a log line, an error message, or a test fixture
• A test exercises the real entry point, not just the redaction function