feat(BRIDGE-WP-0003): MCP server, /bridge-status skill, cross-mode coverage enforcement

Implements the full BRIDGE-WP-0003 workplan: 188 tests passing, 0 lint errors.

## What's added

**Capability registry** (`src/bridge/capabilities.py`):
- 10 capabilities with required_access_modes (cli/mcp/skill)
- Single source of truth for what OpsBridge does and where

**MCP server** (`src/bridge/mcp_server/server.py`):
- 10 FastMCP tools: bridge_up/down/restart/status/logs + 5 catalog_* tools
- 3 resources: bridge://status, catalog://domains, catalog://targets
- `.mcp.json` for project-scope auto-registration
- `scripts/register_mcp.py` for user-scope machine-global registration

**Skill** (`~/.claude/plugins/ops-bridge/bridge-status.md`):
- /bridge-status: health table with emoji indicators + remediation advice

**Cross-mode test coverage enforcement**:
- `tests/conftest.py`: capability/access_mode marks + collect_capability_coverage()
- `tests/test_mcp.py`: 31 FastMCP in-process client tests (Client(mcp) pattern)
- `tests/test_skill.py`: static skill lint against capability registry
- `tests/test_coverage_completeness.py`: meta-test that fails if any required
  (capability × mode) pair lacks a test; also validates CLI commands and MCP
  tools are registered in the capability registry

**ADR** (`architecture/adr-001-cross-mode-capability-registry.md`):
- Documents the registry pattern and FastMCP 3.x testing approach

Key implementation note: FastMCP 3.x in-process results are in
result.content[0].text (JSON string), not result.data directly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_catalog_cli.py

@@ -1,7 +1,6 @@
 """Tests for catalog CLI commands (targets, catalog list/validate/show)."""
 import json
 import textwrap
-from pathlib import Path
 
 import pytest
 from typer.testing import CliRunner
@@ -90,6 +89,8 @@ def env(config_file, tmp_path):
 
 
 class TestTargetsCommand:
+    @pytest.mark.capability("catalog_list_targets")
+    @pytest.mark.access_mode("cli")
     def test_targets_shows_table(self, env):
         result = runner.invoke(app, ["targets"], env=env)
         assert result.exit_code == 0
@@ -120,6 +121,8 @@ class TestTargetsCommand:
         assert result.exit_code == 1
         assert "catalog" in result.output.lower()
 
+    @pytest.mark.capability("catalog_show_target")
+    @pytest.mark.access_mode("cli")
     def test_targets_show_subcommand(self, env):
         result = runner.invoke(app, ["targets", "show", "state-hub"], env=env)
         assert result.exit_code == 0
@@ -132,6 +135,8 @@ class TestTargetsCommand:
 
 
 class TestCatalogCommand:
+    @pytest.mark.capability("catalog_list_domains")
+    @pytest.mark.access_mode("cli")
     def test_catalog_list(self, env):
         result = runner.invoke(app, ["catalog", "list"], env=env)
         assert result.exit_code == 0
@@ -144,6 +149,8 @@ class TestCatalogCommand:
         assert isinstance(data, list)
         assert any(d["domain"] == "coulombcore" for d in data)
 
+    @pytest.mark.capability("catalog_validate")
+    @pytest.mark.access_mode("cli")
     def test_catalog_validate_clean(self, env):
         result = runner.invoke(app, ["catalog", "validate"], env=env)
         assert result.exit_code == 0
@@ -166,6 +173,8 @@ class TestCatalogCommand:
         assert result.exit_code == 1
         assert "missing-bridge" in result.output
 
+    @pytest.mark.capability("catalog_show_bridge")
+    @pytest.mark.access_mode("cli")
     def test_catalog_show(self, env):
         result = runner.invoke(app, ["catalog", "show", "state-hub-coulombcore"], env=env)
         assert result.exit_code == 0