test(cli): cover install metadata read/write and schema guard

[dirtybits]

test(cli): cover install metadata read/write and schema guard

What changed

Added packages/agentvouch-cli/test/metadata.test.ts, a previously-missing test file for the CLI install-metadata module (packages/agentvouch-cli/src/lib/metadata.ts). This module writes and reads the per-skill SKILL.md.agentvouch.json sidecar used by install/update, and its isInstalledSkillMetadata guard is the gate that rejects stale, corrupt, or tampered metadata with an actionable reinstall error. The guard was untested.

Coverage

• getInstallMetadataPath: sidecar path construction.
• buildInstalledSkillMetadata: repo-backed, tree-format, and chain-source mappings, including defaults (default installed_version of 1, historical_sol_price_base_units of 0).
• writeInstalledSkillMetadata: pretty JSON with trailing newline, returns the sidecar path.
• readInstalledSkillMetadata:
  • returns null when the sidecar file does not yet exist (ENOENT);
  • throws CliError on malformed JSON (not install metadata) vs the "not valid JSON" path;
  • rejects objects with a wrong schema_version or invalid source (isInstalledSkillMetadata);
  • accepts legacy metadata that still uses the deprecated price_lamports alias in place of historical_sol_price_base_units.

Why

metadata.ts is the sole writer/reader of the install sidecar; a regression in the schema guard would let corrupt or old-format metadata be accepted (or valid metadata be rejected), breaking update. It had zero test coverage, unlike the surrounding CLI modules (fs, errors, output, http, install, update, vouch).

What was verified

• npm test --workspace @agentvouch/cli — 14 files, 87 tests passing (10 new).
• npx --prefix packages/agentvouch-cli tsc --noEmit -p packages/agentvouch-cli — no type errors.
• npm run format:check — clean (prettier reformatted the new file; no other files touched).

Notes

• Test-only change. No dependency changes; no web build required (and not applicable to this workspace). Follows existing CLI test conventions (real temp-dir round-trips, same as install.test.ts).