feat(plugin): ship the repo's skills as ccam plugin skills

The repo root already IS the `ccam` plugin root (`"source": "./"`), so the
conventional `skills/` dir at the root is the plugin's skills dir — while
`.claude/skills/` only loaded for a session whose cwd was inside this
checkout. That is useless for a lane working in another repo, which is why
`ccam skills install` existed at all.

Move all seven skills to `skills/`: they now reach every plugin user as
`/ccam:<name>` (bare `/<name>` as an alias). `ccam skills install` stays as
the fallback for a plain checkout without the plugin, sourcing from the new
path.

Agents deliberately do NOT move. A plugin agent is addressed as
`ccam:qc-local`, which would break the `subagent_type: qc-local` references
in ship-feature-lane; `ccam lanes agents install` keeps writing them into the
lane's own `.claude/agents/`, the highest-priority agent source. MCP was
already plugin-shipped via `plugins/ccam/.mcp.json`.

Mechanical fallout: ~115 source files carry a doc-comment pointer to
`.claude/skills/file-headers/`, repointed to `skills/file-headers/`. The
generic Claude Code config-surface examples in openapi/cc-config (`.claude/
skills/code-reviewer`) describe any user's layout and are left alone.

Also fixes the two file-headers scripts, whose `ROOT=` climbed four levels
from `.claude/skills/file-headers/scripts/` and would have escaped the repo
from the new depth — it scanned sibling projects until corrected to three.

npm run test:server (1160 pass), test:client (422 pass), mcp:typecheck,
mcp:build + mcp:check-build all green.

skills/mcp-operations/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: mcp-operations
+description: Operate and maintain the local MCP server for this project. Use when creating MCP host config, troubleshooting tool connectivity, modifying tool domains, or adjusting safety policy flags.
+---
+
+# MCP Operations
+
+Use this skill whenever work touches `mcp/` behavior or MCP host integration.
+
+## Core workflow
+- Confirm dashboard API is running (`/api/health`).
+- Confirm MCP server build status.
+- Validate env flags for mutation/destructive modes.
+- Verify host configuration path and command.
+
+## Safe operations policy
+- Default to read-only mode (`MCP_DASHBOARD_ALLOW_MUTATIONS=false`).
+- Enable mutations only for explicit admin tasks.
+- Enable destructive mode only transiently and require explicit confirmation token.
+
+## Required verification for code changes
+- `npm run mcp:typecheck`
+- `npm run mcp:build`
+
+## References
+- Host config examples: `references/host-config.md`
+- Operations runbook: `references/runbook.md`

skills/mcp-operations/references/host-config.md

@@ -0,0 +1,18 @@
+# MCP Host Config
+
+## Command
+- `node`
+
+## Args
+- Absolute path to `mcp/build/index.js`
+
+## Example env
+- `MCP_DASHBOARD_BASE_URL=http://127.0.0.1:4820`
+- `MCP_DASHBOARD_ALLOW_MUTATIONS=false`
+- `MCP_DASHBOARD_ALLOW_DESTRUCTIVE=false`
+- `MCP_LOG_LEVEL=info`
+
+## Common mistakes
+- Relative path to MCP build entry.
+- Dashboard not running while MCP starts.
+- Mutating tools used while mutation flag is false.

skills/mcp-operations/references/runbook.md

@@ -0,0 +1,19 @@
+# MCP Runbook
+
+## Read-only daily mode
+- Keep both mutation flags false.
+- Use read tools for observability and reporting.
+
+## Admin mode
+- Set `MCP_DASHBOARD_ALLOW_MUTATIONS=true`.
+- Run maintenance/pricing operations.
+- Reset mutation flag to false after completion.
+
+## Destructive mode
+- Set both mutation and destructive flags true.
+- Execute destructive command only with explicit confirmation token.
+- Immediately disable destructive flag after operation.
+
+## Verification commands
+- `npm run mcp:typecheck`
+- `npm run mcp:build`