feat: structured logging for provider diagnostics + Cursor SDK rules/skills logs - #85

Two conflicts, both resolved to keep each side's intent:

- language-model.ts: #85/#86 moved the resolveSystemDelivery call inside
  the withSessionLock callback. The skills-catalogue lookup was re-placed
  into that relocated call rather than restored to its old position.
- CHANGELOG.md: the skills-bridge entry stays under [Unreleased]; main's
  0.6.2 and 0.7.0 release sections are kept in full.

0.7.0 (#85) moved the plugin's own diagnostics off console.* and onto
opencode's structured logging API. The skills bridge predated that and
still wrote to the terminal, leaving the only console.* calls in src/.

Withheld skills and the mirror-failure path now pass structured extra
fields instead of pre-formatted strings, so the reason codes are
queryable rather than embedded in a message.

Also corrects the plugin-cache path in the README limitation: it is
platform-dependent, as PLUGIN_CACHE_PATH shows, and was documented as
POSIX-only.

…scovery (#90)

* feat: mirror opencode skills into .cursor/skills/ for Cursor agent discovery

Discover opencode's resolved skills (project + global + config.skills.paths),
filter through permission config, and materialise them as a git-ignored mirror
in <cwd>/.cursor/skills/ with a 'generated: opencode-cursor' sentinel. An
<available_skills> catalogue is appended to the generated system rule so the
Cursor agent can discover and load skills on demand.

- New: src/plugin/skill-discovery.ts — filesystem walk, frontmatter parsing,
  permission filtering (map-form + rule-array), extraPaths, path expansion,
  skillSetHash including all files (mtime + size).
- New: src/provider/skill-mirror.ts — materialisation with sentinel, git-ignore,
  idempotent writes, stale-dir pruning, user-owned protection, per-file 1MB
  skip, total 10MB cap, removeSkillMirror for dispose, buildSkillsCatalogue.
- Updated: src/provider/system-rule.ts — writeSystemRule and
  resolveSystemDelivery accept optional skillsCatalogue appended to rule body.
- Updated: src/plugin/index.ts — forwardSkills option (default true),
  skills.include/exclude override, materialisation in config hook, live
  re-sync in chat.params hook (hash-gated), currentSkillsCatalogue always
  forwarded per turn, removeSkillMirror in dispose.
- Updated: src/provider/language-model.ts — dynamic + static catalogue
  resolution (no self-provisioning — respects forwardSkills:false).
- Updated: src/provider/delegate.ts + src/plugin/cursor-tools.ts —
  settingSources: ['project'] passed to delegate's acquireAgent.
- Updated: src/provider/index.ts — skillsCatalogue in provider options.
- Tests: 403 passing (25 skill-discovery, 14 skill-mirror, 10 plugin-skill-
  mirror, 6 catalogue in language-model-system, plus existing).
- Docs: README.md (Skills section), CHANGELOG.md ([Unreleased]),
  SECURITY.md (skills mirror threat model).
- .gitignore: exclude .cursor/ (plugin-generated runtime artifacts).

* fix(skills): follow symlinked skill dirs and files

Dirent.isDirectory() is false for a symlink pointing at a directory, so
a skill linked in from a shared checkout was dropped from the mirror
with no warning. Symlinked supporting files were lost the same way.

Entries are now classified through the link target, with a resolved-path
visited set guarding the cycles that following links admits.

* docs(skills): correct deny scope, note plugin-skill gap

skills.include is checked before permissions resolve, so it re-admits a
denied skill by design — SECURITY.md read as though deny were absolute.

Skills bundled in opencode plugin packages live in the package cache,
which is not a scanned location, and the SDK exposes no skills API to
resolve them. Documented so the omission is visible rather than silent.

* style(plugin): normalize indentation in skills bridge blocks

* refactor(skills): route mirror diagnostics through pluginLog

0.7.0 (#85) moved the plugin's own diagnostics off console.* and onto
opencode's structured logging API. The skills bridge predated that and
still wrote to the terminal, leaving the only console.* calls in src/.

Withheld skills and the mirror-failure path now pass structured extra
fields instead of pre-formatted strings, so the reason codes are
queryable rather than embedded in a message.

Also corrects the plugin-cache path in the README limitation: it is
platform-dependent, as PLUGIN_CACHE_PATH shows, and was documented as
POSIX-only.

---------

Co-authored-by: Wayne Simpson <wayne@nocodecreative.io>