feat(cli): add installable sideshow skill

[tridha643]

Summary

• add sideshow skill path and sideshow skill install so npm users can discover/install the packaged agent skill without a repo checkout
• expand the sideshow skill with MCP, CLI, HTTP fallback, realtime feedback, auth, session recovery, and troubleshooting guidance
• document npm-safe skill installation in README/setup docs and move default local JSON storage to a user data directory while preserving SIDESHOW_DATA
• tolerate pasted inline comments after sideshow serve (e.g. # viewer on ...)

Research

• used Nia to index/search modem-dev/sideshow
• used skills CLI discovery; no existing high-quality sideshow-specific skill was available
• used realtime workflow fan-out to inspect CLI, MCP, and npm packaging surfaces

Validation

• npm test
• npm run typecheck
• npm run lint
• npm run format:check
• npm run build
• npm pack --dry-run
• manual: node bin/sideshow.js serve --port 4250 '#' pasted comment starts without parseArgs failure

[tridha643]

Additional end-to-end validation after opening the PR:

• Local branch CLI E2E: started node bin/sideshow.js serve, published a snippet, updated the same snippet, posted a simulated user comment via API, and verified sideshow wait --session ... returned that feedback.
• HTTP MCP E2E: called initialize, tools/list, publish_snippet, posted simulated user feedback, and verified wait_for_feedback returned it with lastSeq.
• Packaged npm tarball CLI E2E: ran npm pack, installed the tarball into a temp project, verified sideshow skill path and sideshow skill install --target ..., then started the packaged CLI server and verified publish → update → user comment → wait.

Packaged CLI E2E result included: PACKAGED_CLI_E2E_OK session=6771226d snippet=71f03172.

[tridha643]

some changes I have to address before this is good to merge

[tridha643]

Addressed the review feedback on the skill doc:

• Restored the original opening wording about the user keeping a sideshow surface open and the two-way comment loop.
• Restored the original "Before your first publish", "Publishing", rules-of-thumb, "The feedback loop", and "Remote surfaces" sections instead of replacing them.
• Kept the new details as additive sections/paragraphs: use cases, transport order, MCP workflow details, HTTP fallback, session recovery, auth/cookie note, snippet constraints, and troubleshooting.

Validation after the change:

• npm test
• npm run typecheck
• npm run lint
• npm run format:check
• npm run build

[tridha643]

Fresh package reinstall verification:

• Packed the current PR branch with npm pack.
• Created a clean temp project and installed the tarball.
• Verified node_modules/sideshow/skills/sideshow/SKILL.md exists immediately after install.
• Ran ./node_modules/.bin/sideshow skill path and verified it points at the bundled skill directory.
• Deleted the package with npm uninstall sideshow and verified node_modules/sideshow was gone.
• Reinstalled the same tarball and verified the bundled skill file and sideshow skill path again.
• Ran sideshow skill install --target <tmp> from the reinstalled package and verified it copied SKILL.md.

Result: REINSTALL_BUNDLED_SKILL_OK. The skill is bundled in the npm package by default.