fix: tighten the claim-state types and the agent-contract example

Review follow-ups on the nudges.

`ClaimState`'s `attached` variant made `claimed_at` optional even though
`claimState` only ever produces that variant when both `claimed_at` and
`team_id` are present, so the optionality described a state that cannot
occur. Making it required lets the type say what the constructor
guarantees, and the test that built an `attached` value without a
timestamp now has to supply one.

The doctor check declared `state` untyped, leaving it an evolving `any`
and its `ClaimState` import unused. It is annotated now.

The `attached` example in the agent contract was not valid JSON: it
listed the key names with no values, which is the one thing a document
aimed at agents should not do.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: IAM-marco

apps/cli/SKILLS.md

@@ -148,7 +148,8 @@ the CLI's help layer, not the envelope.
   `setup`, `status`, and `doctor` report whether a team is attached, reading
   `claimed_at`/`team_id` from `.zitadel/secret` (no platform call). `status`
   carries `data.project.claim` as `{"kind": "detached"}` or
-  `{"kind": "attached", "team_id", "claimed_at"}`, and `doctor` reports a
+  `{"kind": "attached", "team_id": "team_01H…", "claimed_at": "2026-08-01T09:00:00.000Z"}`,
+  and `doctor` reports a
   `claim` check. A project with no team is only ever a **warning**, never a
   failure — it works exactly like one with a team, so `doctor` still exits 0
   and `--fix` deliberately does nothing (a claim needs a human in a browser).

apps/cli/src/commands/doctor/checks/claim.ts

@@ -23,7 +23,7 @@ export class ClaimCheck implements SanityCheck {
   readonly path = ".zitadel/secret";
 
   async run(ctx: CheckContext): Promise<CheckOutcome> {
-    let state;
+    let state: ClaimState;
     try {
       state = claimState({
         secret: await readZitadelSecret(ctx.cwd),

apps/cli/src/lib/claim-state.ts

@@ -10,7 +10,7 @@ import { publicCliCommand } from "./public-cli";
  * opposite output: the first prints nothing at all, the second nudges.
  */
 export type ClaimState =
-  | { kind: "attached"; team_id: string; claimed_at?: string }
+  | { kind: "attached"; team_id: string; claimed_at: string }
   | { kind: "detached" }
   | { kind: "not-applicable" };
 

apps/cli/tests/unit/commands/status.test.ts

@@ -118,7 +118,7 @@ describe("status command", () => {
 
     const json = parseJson(res.stdout) as {
       data: {
-        project: { claim?: { kind: string; team_id?: string } };
+        project: { claim?: { kind: string; team_id?: string; claimed_at?: string } };
         next_actions: string[];
         next_commands: string[];
       };

apps/cli/tests/unit/lib/claim-state.test.ts

@@ -51,7 +51,7 @@ describe("claim state", () => {
 
 describe("claim copy", () => {
   it("names the owning team once attached and nudges otherwise", () => {
-    expect(claimSummary({ kind: "attached", team_id: "team-001" })).toBe(
+    expect(claimSummary({ kind: "attached", team_id: "team-001", claimed_at: ATTACHED.claimed_at })).toBe(
       "attached to team team-001",
     );
     expect(claimSummary({ kind: "detached" })).toBe("temporary until you attach it to a team");
@@ -71,7 +71,7 @@ describe("claim copy", () => {
     for (const copy of [
       claimAction("0.1.0"),
       claimSummary({ kind: "detached" }) ?? "",
-      claimSummary({ kind: "attached", team_id: "team-001" }) ?? "",
+      claimSummary({ kind: "attached", team_id: "team-001", claimed_at: ATTACHED.claimed_at }) ?? "",
     ]) {
       expect(copy).not.toMatch(/\bunclaimed\b/i);
     }