feat(cli): scaffold @claudemesh/cli MCP client package (stubs)

The user-facing tool. Two invocation modes:
  - `claudemesh mcp`           → MCP server (stdio), consumed by Claude Code
  - `claudemesh <subcommand>`  → human CLI

Layout:
  apps/cli/
  ├── package.json       bin: { claudemesh: ./src/index.ts }
  ├── README.md          install + usage
  └── src/
      ├── index.ts       dispatcher (mcp | install | join | list | leave | --help)
      ├── env.ts         CLAUDEMESH_BROKER_URL, CONFIG_DIR, DEBUG
      ├── mcp/
      │   ├── server.ts  MCP stdio server with 5 tools
      │   ├── tools.ts   tool schemas (send_message, list_peers,
      │   │              check_messages, set_summary, set_status)
      │   └── types.ts
      ├── ws/client.ts   broker connection (stub for 15b)
      ├── state/config.ts ~/.claudemesh/config.json (joined meshes + keys)
      └── commands/
          ├── install.ts print `claude mcp add ...` instruction
          ├── join.ts    parse ic://join/... (stub, Step 17)
          ├── list.ts    show joined meshes
          └── leave.ts   remove mesh from local config

Tool stubs return "not connected, run `claudemesh join <invite-link>`"
errors until 15b wires the WS client.

Verified:
- `bun src/index.ts --help` → prints usage
- `bun src/index.ts install` → prints MCP add command with resolved path
- `bun src/index.ts list` → "No meshes joined yet"
- `bun src/index.ts mcp` (via stdin) → returns tools/list with all 5 tools

Deps: @modelcontextprotocol/sdk, ws, libsodium-wrappers, zod.
Lockfile regenerated in the same commit per claudemesh-3's flag —
avoids breaking Coolify's --frozen-lockfile deploys.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli/src/ws/client.ts

@@ -0,0 +1,40 @@
+/**
+ * WS client to the broker (STUB).
+ *
+ * Final implementation in Step 15b — connects to broker, sends hello
+ * (with signed nonce), pumps messages to/from the MCP server, handles
+ * reconnect. For now just a placeholder type surface so the MCP
+ * server can depend on it.
+ */
+
+import type { JoinedMesh } from "../state/config";
+
+export interface BrokerConnection {
+  meshId: string;
+  isConnected(): boolean;
+  sendMessage(args: {
+    targetSpec: string;
+    priority: "now" | "next" | "low";
+    nonce: string;
+    ciphertext: string;
+  }): Promise<{ ok: boolean; messageId?: string; error?: string }>;
+  close(): void;
+}
+
+/**
+ * Stub broker connection. Returns "not implemented" errors on every
+ * call. Real implementation in 15b will connect to env.CLAUDEMESH_BROKER_URL.
+ */
+export function connectBroker(_mesh: JoinedMesh): BrokerConnection {
+  return {
+    meshId: _mesh.meshId,
+    isConnected: () => false,
+    sendMessage: async () => ({
+      ok: false,
+      error: "broker client not implemented (Step 15b)",
+    }),
+    close: () => {
+      /* noop */
+    },
+  };
+}