feat(cli): 1.5.0 — CLI-first architecture, tool-less MCP, policy engine

CLI becomes the API; MCP becomes a tool-less push-pipe. Bundle -42%
(250 KB → 146 KB) after stripping ~1700 lines of dead tool handlers.

- Tool-less MCP: tools/list returns []. Inbound peer messages still
  arrive as experimental.claude/channel notifications mid-turn.
- Resource-noun-verb CLI: peer list, message send, memory recall, etc.
  Legacy flat verbs (peers, send, remember) remain as aliases.
- Bundled claudemesh skill auto-installed by `claudemesh install` —
  sole CLI-discoverability surface for Claude.
- Unix-socket bridge: CLI invocations dial the push-pipe's warm WS
  (~220 ms warm vs ~600 ms cold).
- --mesh <slug> flag: connect a session to multiple meshes.
- Policy engine: every broker-touching verb runs through a YAML gate
  at ~/.claudemesh/policy.yaml (auto-created). Destructive verbs
  prompt; non-TTY auto-denies. Audit log at ~/.claudemesh/audit.log.
- --approval-mode plan|read-only|write|yolo + --policy <path>.

Spec: .artifacts/specs/2026-05-02-architecture-north-star.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/cli/src/commands/whoami.ts

@@ -1,5 +1,6 @@
 import { whoAmI } from "~/services/auth/facade.js";
-import { dim, icons } from "~/ui/styles.js";
+import { render } from "~/ui/render.js";
+import { bold, dim } from "~/ui/styles.js";
 import { EXIT } from "~/constants/exit-codes.js";
 
 export async function whoami(opts: { json?: boolean }): Promise<number> {
@@ -11,16 +12,19 @@ export async function whoami(opts: { json?: boolean }): Promise<number> {
   }
 
   if (!result.signed_in) {
-    console.log(`  Not signed in. Run \`claudemesh login\` to sign in.`);
+    render.err("Not signed in", "Run `claudemesh login` to sign in.");
     return EXIT.AUTH_FAILED;
   }
 
-  console.log(`\n  Signed in as ${result.user!.display_name} (${result.user!.email})`);
-  console.log(`  Token source: ${result.token_source} ${dim("(~/.claudemesh/auth.json)")}`);
-  if (result.meshes) {
-    console.log(`  Meshes: ${result.meshes.owned} owned, ${result.meshes.guest} guest`);
-  }
-  console.log();
+  render.section("whoami");
+  render.kv([
+    ["user", `${bold(result.user!.display_name)} ${dim(`(${result.user!.email})`)}`],
+    ["token", `${result.token_source} ${dim("(~/.claudemesh/auth.json)")}`],
+    ...(result.meshes
+      ? [["meshes", `${result.meshes.owned} owned · ${result.meshes.guest} guest`] as [string, string]]
+      : []),
+  ]);
+  render.blank();
 
   return EXIT.SUCCESS;
 }