feat(cli): context-bill — token bill-of-materials (stripped port)

lib/context-bill.ts, ported from the v2 fork and STRIPPED to the tiers
this repo's skills can exercise: ALWAYS-ON (per-skill frontmatter bytes
with dead-key and foreign-host-file flags), EAGER (SKILL.md + any
forced 'for every invocation' references), on-disk totals, --diff,
--budget, and --exact with the calibration table. The fork's
CONDITIONAL/TRANSITIVE/LAZY/FAST-PATH parsers understand only its
dispatcher layout and were dropped; the tier fields stay in the report
shape (empty/zero/null) so re-adding a parser is additive.
TOKEN_DIVISORS and their provenance docblock kept; --help notes
recalibration via --exact's calibration block.

Three upstream fixes over the fork:
(a) findSkillDirs treats the walk ROOT as a container — the repo root's
    router SKILL.md is billed AND its children are walked (the fork
    short-circuited and billed one skill); walkMd skips node_modules
    and dot-directories.
(b) installed-tree layout: subdirs that are their own repo checkout
    (a gstack/ clone inside ~/.claude/skills, detected by .git) are
    skipped, and directory symlinks (connect-chrome) are followed with
    a container-recursion cycle guard.
(c) ROUTER_KEYS widened to the upstream frontmatter contract {name,
    description, version, allowed-tools, triggers, preamble-tier}.

--exact writes an egress receipt (sink context-bill-exact, host
api.anthropic.com) BEFORE any count_tokens POST; if the receipt cannot
be written the run degrades to the offline estimate with a warning —
nothing is sent unrecorded. bin/gstack-context-bill is the bun shim.

Tests: fixture-tree ledgers, the three fixes, --diff/--budget exit
codes, --exact with injected fetch (envelope subtraction, receipt
ordering, fail-open degradation), CLI smoke test, and ground truth
against THIS repo via test/helpers/skill-census.ts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 675c19876b87ec927b555f5f64c7f93130b3de90)

test/fixtures/context-bill/tree-a/alpha/SKILL.md

@@ -0,0 +1,21 @@
+---
+name: alpha
+description: Fixture dispatcher with a mode table and forced-read references.
+triggers: a-key-the-upstream-router-DOES-read
+x-dead-key: a-key-no-router-reads
+---
+
+# Alpha
+
+## Dispatch protocol
+
+1. Infer the mode from the request.
+2. Read `references/CORE.md` and `references/POLICY.md` for every invocation. Read `references/OPTIONAL.md` before public-web work.
+3. When the target is a repository, read `references/CORE.md` once before specialist work; it is already billed eagerly.
+
+## Top-level modes
+
+| Mode | Infer when | Candidate internal specialists |
+|---|---|---|
+| `Discovery` | The idea is fluid. | `references/legacy/office.md` |
+| `Full chain` | Everything at once. | `references/legacy/auto.md` |

test/fixtures/context-bill/tree-a/alpha/references/CORE.md

@@ -0,0 +1,3 @@
+# Core
+
+Forced-read reference number one. Read on every invocation of alpha.

test/fixtures/context-bill/tree-a/alpha/references/OPTIONAL.md

@@ -0,0 +1,3 @@
+# Optional
+
+Conditional reference. Not part of the eager bill.

test/fixtures/context-bill/tree-a/alpha/references/POLICY.md

@@ -0,0 +1,3 @@
+# Policy
+
+Forced-read reference number two.

test/fixtures/context-bill/tree-a/beta/SKILL.md

@@ -0,0 +1,8 @@
+---
+name: beta
+description: Clean fixture tool skill with no forced reads and no mode table.
+---
+
+# Beta
+
+One-command tool skill. Nothing eager beyond this file, nothing lazy.

test/fixtures/context-bill/tree-a/beta/agents.md

@@ -0,0 +1,3 @@
+# Foreign host file
+
+A skill-shaped file another host dropped into scanner scope (#1694).