feat(BRIDGE-WP-0003): MCP server, /bridge-status skill, cross-mode coverage enforcement

Implements the full BRIDGE-WP-0003 workplan: 188 tests passing, 0 lint errors.

## What's added

**Capability registry** (`src/bridge/capabilities.py`):
- 10 capabilities with required_access_modes (cli/mcp/skill)
- Single source of truth for what OpsBridge does and where

**MCP server** (`src/bridge/mcp_server/server.py`):
- 10 FastMCP tools: bridge_up/down/restart/status/logs + 5 catalog_* tools
- 3 resources: bridge://status, catalog://domains, catalog://targets
- `.mcp.json` for project-scope auto-registration
- `scripts/register_mcp.py` for user-scope machine-global registration

**Skill** (`~/.claude/plugins/ops-bridge/bridge-status.md`):
- /bridge-status: health table with emoji indicators + remediation advice

**Cross-mode test coverage enforcement**:
- `tests/conftest.py`: capability/access_mode marks + collect_capability_coverage()
- `tests/test_mcp.py`: 31 FastMCP in-process client tests (Client(mcp) pattern)
- `tests/test_skill.py`: static skill lint against capability registry
- `tests/test_coverage_completeness.py`: meta-test that fails if any required
  (capability × mode) pair lacks a test; also validates CLI commands and MCP
  tools are registered in the capability registry

**ADR** (`architecture/adr-001-cross-mode-capability-registry.md`):
- Documents the registry pattern and FastMCP 3.x testing approach

Key implementation note: FastMCP 3.x in-process results are in
result.content[0].text (JSON string), not result.data directly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_cli.py

@@ -1,8 +1,6 @@
 """Tests for CLI commands."""
 import json
-import os
 import textwrap
-from pathlib import Path
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -74,6 +72,8 @@ class TestHelpCommand:
 
 
 class TestStatusCommand:
+    @pytest.mark.capability("bridge_status")
+    @pytest.mark.access_mode("cli")
     def test_status_shows_tunnels(self, env, state_dir):
         result = runner.invoke(app, ["status"], env=env)
         assert result.exit_code == 0
@@ -106,6 +106,8 @@ class TestUpCommand:
         assert result.exit_code == 1
         assert "nonexistent" in result.output
 
+    @pytest.mark.capability("bridge_up")
+    @pytest.mark.access_mode("cli")
     def test_up_calls_manager_start(self, env, state_dir):
         with patch("bridge.cli.TunnelManager") as mock_mgr_cls:
             mock_mgr = MagicMock()
@@ -133,6 +135,8 @@ class TestDownCommand:
         result = runner.invoke(app, ["down", "nonexistent"], env=env)
         assert result.exit_code == 1
 
+    @pytest.mark.capability("bridge_down")
+    @pytest.mark.access_mode("cli")
     def test_down_calls_manager_stop(self, env, state_dir):
         with patch("bridge.cli.TunnelManager") as mock_mgr_cls:
             mock_mgr = MagicMock()
@@ -164,6 +168,8 @@ class TestLogsCommand:
         result = runner.invoke(app, ["logs", "test-tunnel"], env=env)
         assert result.exit_code == 0
 
+    @pytest.mark.capability("bridge_logs")
+    @pytest.mark.access_mode("cli")
     def test_logs_shows_events(self, env, state_dir):
         import json as _json
         state_dir.mkdir(parents=True, exist_ok=True)
@@ -187,6 +193,8 @@ class TestRestartCommand:
         result = runner.invoke(app, ["restart", "nonexistent"], env=env)
         assert result.exit_code == 1
 
+    @pytest.mark.capability("bridge_restart")
+    @pytest.mark.access_mode("cli")
     def test_restart_calls_stop_then_start(self, env):
         with patch("bridge.cli.TunnelManager") as mock_mgr_cls:
             mock_mgr = MagicMock()