release: prepare Direct v0.7.30 with signed-in and per-agent skill docs

[0thernet]

Summary

• README: "Open a signed-in state without real credentials" (under the article's verification walkthrough). Put sign-in behind a product port, declare account.signed-in and account.signed-out scenarios on /settings, and keep the identity provider as a direct coverage claim with no scenarios; open the state with ?__direct_scenario=account.signed-in, confirm it from window.__direct, and keep Playwright saved auth state for the real sign-in. The definition was replayed against Direct's own source (defineDirect plus createDirectSession with query activation): each scenario opens, the manifest's active entry reports the scenario and /settings, and the coverage modes are fixture, fixture, direct.
• README: "Install the Agent Skill" now lists, for Claude Code, Codex, Cursor, and Devin CLI, the global and project folders the skills installer writes and how to invoke the skill (/direct, $direct or /skills, the / menu). On 2026-10-04, skills 1.7.0 wrote these folders (the Claude Code and Devin CLI folders are links to the .agents copy) and Codex 0.160.0 listed the skill from both of its folders; the README says Claude Code, Cursor, and Devin CLI were not run with it. The install prompt says how to start it in each agent.
• Version bump to 0.7.30, following docs/publishing.md: strictly increasing (v0.7.30 tag unused; Latest is v0.7.29), CHANGELOG.md ## 0.7.30 section, and the package identity test moved with package.json. Install examples stay on the delivered v0.7.29 until the new assets are live. Immutable releases are enabled and the two refs/tags/v* rulesets read back as documented. Between v0.7.29 and this head only docs changed, so the changelog says exports and tooling are unchanged.
• skills/direct/references/install.md now says the skill ships with @hraness/direct@0.7.30 and keeps the last verified 0.7.29 install, which already includes createVerificationBrowser (added in 0.7.28). The package smoke requires the package-version pin in that file; the draft had instead called the factory new in 0.7.30.

Release and hraness.com/direct steps after merge

1. Squash merge on green Required; CI on main passes; auto-tag.yml creates the annotated v0.7.30 tag through the release tagger App.
2. The tag runs release.yml: full bun run check, isolated install, attestation, immutable five-asset GitHub Release "Direct v0.7.30", then the npm mirror through OIDC. Confirm the five assets, immutable Latest, and the npm readback separately.
3. Follow-up PR here (as in Point install examples at verified Direct v0.7.29 #84): move install examples in README.md, docs/adoption.md, docs/publishing.md, docs/verification.md, and skills/direct/references/install.md from v0.7.29 to v0.7.30.
4. In hraness/jungle (merge queue): change the catalog pin at package.json:23 from github:hraness/direct#v0.7.20 to #v0.7.30, regenerate portfolio-inventory.generated.json from portfolio-inventory.fragment.json:476, update the pinned strings in projects/hraness/app/direct/page.test.tsx:40,43 and scripts/standalone-tool-dependencies.test.ts:230, refresh bun.lock, and check projects/hraness/app/direct/launch/facts.ts:19 (v0.7.24 release URL).
5. After hraness.com deploys, curl https://hraness.com/direct.md and confirm the "When to use Direct" table, the two new sections, and the version string.

Test plan

• host-run --mode=heavy --lane=compute -- bun run check with npm 11.19.0 first on PATH (the repository's pinned npm) on 312c845: exit 0, including the package smoke, 466 unit tests, the todo example verify, and the React Native iOS, Android, and web export boundaries; no generated drift. An earlier run with the machine's npm 11.16.0 failed only the 12 historical canonical npm package identity cases on npm 11.19.0 is required, received 11.16.0.
• Offline replay of the README definition against src/index.ts and src/testing/index.ts.
• skills 1.7.0 global and project installs in isolated HOME folders (telemetry disabled); codex debug prompt-input lists direct from ~/.agents/skills and .agents/skills without a model call.
• Read-only release controls: gh api repos/hraness/direct/immutable-releases (enabled), rulesets 19251098 and 21703866, gh release list, git ls-remote --tags.
• Not run: the signed-in scenario in a browser or in examples/todos (the README sample is illustrative, not a shipped example); skill discovery or invocation in Claude Code, Cursor, or Devin CLI; the release itself.
• Required CI: the first head failed test:package on the missing @hraness/direct@0.7.30 pin in the packaged install reference; fixed in 312c845, and check plus Required pass on that head.