feat(BRIDGE-WP-0003): MCP server, /bridge-status skill, cross-mode coverage enforcement

Implements the full BRIDGE-WP-0003 workplan: 188 tests passing, 0 lint errors.

## What's added

**Capability registry** (`src/bridge/capabilities.py`):
- 10 capabilities with required_access_modes (cli/mcp/skill)
- Single source of truth for what OpsBridge does and where

**MCP server** (`src/bridge/mcp_server/server.py`):
- 10 FastMCP tools: bridge_up/down/restart/status/logs + 5 catalog_* tools
- 3 resources: bridge://status, catalog://domains, catalog://targets
- `.mcp.json` for project-scope auto-registration
- `scripts/register_mcp.py` for user-scope machine-global registration

**Skill** (`~/.claude/plugins/ops-bridge/bridge-status.md`):
- /bridge-status: health table with emoji indicators + remediation advice

**Cross-mode test coverage enforcement**:
- `tests/conftest.py`: capability/access_mode marks + collect_capability_coverage()
- `tests/test_mcp.py`: 31 FastMCP in-process client tests (Client(mcp) pattern)
- `tests/test_skill.py`: static skill lint against capability registry
- `tests/test_coverage_completeness.py`: meta-test that fails if any required
  (capability × mode) pair lacks a test; also validates CLI commands and MCP
  tools are registered in the capability registry

**ADR** (`architecture/adr-001-cross-mode-capability-registry.md`):
- Documents the registry pattern and FastMCP 3.x testing approach

Key implementation note: FastMCP 3.x in-process results are in
result.content[0].text (JSON string), not result.data directly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/bridge/capabilities.py

@@ -0,0 +1,73 @@
+"""Canonical capability registry for OpsBridge.
+
+Every operation that can be invoked via CLI, MCP, or Skill must be listed here.
+The cross-mode test suite uses this registry to enforce test coverage parity.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+ACCESS_MODES = frozenset({"cli", "mcp", "skill"})
+
+
+@dataclass(frozen=True)
+class Capability:
+    name: str
+    description: str
+    required_access_modes: frozenset[str]
+
+
+CAPABILITIES: list[Capability] = [
+    Capability(
+        name="bridge_up",
+        description="Start one or all tunnels",
+        required_access_modes=frozenset({"cli", "mcp"}),
+    ),
+    Capability(
+        name="bridge_down",
+        description="Stop one or all tunnels",
+        required_access_modes=frozenset({"cli", "mcp"}),
+    ),
+    Capability(
+        name="bridge_restart",
+        description="Restart one or all tunnels",
+        required_access_modes=frozenset({"cli", "mcp"}),
+    ),
+    Capability(
+        name="bridge_status",
+        description="Show tunnel status",
+        required_access_modes=frozenset({"cli", "mcp", "skill"}),
+    ),
+    Capability(
+        name="bridge_logs",
+        description="Tail tunnel audit log",
+        required_access_modes=frozenset({"cli", "mcp"}),
+    ),
+    Capability(
+        name="catalog_list_targets",
+        description="List catalog targets",
+        required_access_modes=frozenset({"cli", "mcp"}),
+    ),
+    Capability(
+        name="catalog_show_target",
+        description="Show target metadata",
+        required_access_modes=frozenset({"cli", "mcp"}),
+    ),
+    Capability(
+        name="catalog_list_domains",
+        description="List catalog domains",
+        required_access_modes=frozenset({"cli", "mcp"}),
+    ),
+    Capability(
+        name="catalog_validate",
+        description="Validate catalog consistency",
+        required_access_modes=frozenset({"cli", "mcp"}),
+    ),
+    Capability(
+        name="catalog_show_bridge",
+        description="Show bridge metadata",
+        required_access_modes=frozenset({"cli", "mcp"}),
+    ),
+]
+
+CAPABILITIES_BY_NAME: dict[str, Capability] = {c.name: c for c in CAPABILITIES}