feat(cli): scaffold @claudemesh/cli MCP client package (stubs)

The user-facing tool. Two invocation modes:
  - `claudemesh mcp`           → MCP server (stdio), consumed by Claude Code
  - `claudemesh <subcommand>`  → human CLI

Layout:
  apps/cli/
  ├── package.json       bin: { claudemesh: ./src/index.ts }
  ├── README.md          install + usage
  └── src/
      ├── index.ts       dispatcher (mcp | install | join | list | leave | --help)
      ├── env.ts         CLAUDEMESH_BROKER_URL, CONFIG_DIR, DEBUG
      ├── mcp/
      │   ├── server.ts  MCP stdio server with 5 tools
      │   ├── tools.ts   tool schemas (send_message, list_peers,
      │   │              check_messages, set_summary, set_status)
      │   └── types.ts
      ├── ws/client.ts   broker connection (stub for 15b)
      ├── state/config.ts ~/.claudemesh/config.json (joined meshes + keys)
      └── commands/
          ├── install.ts print `claude mcp add ...` instruction
          ├── join.ts    parse ic://join/... (stub, Step 17)
          ├── list.ts    show joined meshes
          └── leave.ts   remove mesh from local config

Tool stubs return "not connected, run `claudemesh join <invite-link>`"
errors until 15b wires the WS client.

Verified:
- `bun src/index.ts --help` → prints usage
- `bun src/index.ts install` → prints MCP add command with resolved path
- `bun src/index.ts list` → "No meshes joined yet"
- `bun src/index.ts mcp` (via stdin) → returns tools/list with all 5 tools

Deps: @modelcontextprotocol/sdk, ws, libsodium-wrappers, zod.
Lockfile regenerated in the same commit per claudemesh-3's flag —
avoids breaking Coolify's --frozen-lockfile deploys.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli/README.md

@@ -0,0 +1,59 @@
+# @claudemesh/cli
+
+Client tool for claudemesh — install once per machine, join one or more
+meshes, and your Claude Code sessions can talk to peers on demand.
+
+## Install
+
+```sh
+# From npm (once published)
+npm install -g @claudemesh/cli
+
+# Or from the monorepo during dev
+cd apps/cli && bun link
+```
+
+Then register the MCP server with Claude Code:
+
+```sh
+claudemesh install
+# prints:  claude mcp add claudemesh --scope user -- claudemesh mcp
+```
+
+Run the printed command, then restart Claude Code.
+
+## Join a mesh
+
+```sh
+claudemesh join ic://join/BASE64URL...
+```
+
+The invite link is generated by whoever runs the mesh. It bundles the
+mesh id, expiry, signing key, and role. Your CLI verifies it,
+generates a fresh keypair, enrolls you with the broker, and persists
+the result to `~/.claudemesh/config.json`.
+
+## Commands
+
+```sh
+claudemesh install         # print MCP registration command
+claudemesh join <link>     # join a mesh via invite link
+claudemesh list            # show joined meshes + identities
+claudemesh leave <slug>    # leave a mesh
+claudemesh mcp             # start MCP server (stdio — Claude Code only)
+claudemesh --help          # show usage
+```
+
+## Env overrides
+
+| Var                     | Default                      | Purpose                        |
+| ----------------------- | ---------------------------- | ------------------------------ |
+| `CLAUDEMESH_BROKER_URL` | `wss://ic.claudemesh.com/ws` | Point at a self-hosted broker  |
+| `CLAUDEMESH_CONFIG_DIR` | `~/.claudemesh/`             | Override config location       |
+| `CLAUDEMESH_DEBUG`      | `0`                          | Verbose logging                |
+
+## Status
+
+v0.1.0 scaffold — CLI commands + MCP server shell in place. WS broker
+connection, libsodium crypto, invite-link verification, and auto-install
+of hooks land in subsequent steps.