feat(skill): teach AuthKit-native agent auth (zero auth agent register/claim)

[spencercharest]

Closes ZERO-483. Follows piedotorg/zero#748 (ZERO-477), which shipped the AuthKit-native agent auth surface in the CLI.

What changed

The bundled zero skill now teaches the new onboarding surface:

• Decision rule first, commands second. The Authentication section opens with who is the account for: human present → zero auth login (device flow; creates the account on first sign-in; zero auth register is an alias), fully autonomous → zero auth agent register (anonymous account + managed wallet, no browser), and never agent register to sign a human in — it mints an account owned by no one.
• New "Autonomous" section covering zero auth agent register --json: session persisted like any login, managed wallet created at signup (fund with zero wallet fund, --no-open for the one-time URL), claim token + expiry recorded in ~/.zero/config.json (claimTokenExpires), unclaimed accounts cleaned up after the registration expires.
• New "Claim handoff" section for zero auth agent claim <email>: explicitly the reverse of the device flow — the hosted page shows the human the pairing code, they read it back, the agent completes inline (TTY) or with the second-invocation --code <code> pattern. Notes that re-running without --code invalidates the code in flight, and that post-claim the CLI rotates onto fresh credentials automatically.
• Funding section now covers agent-registered accounts (no human profile to point at → zero wallet fund --no-open), and the "never create a wallet" guidance is sharpened to "never generate a private-key wallet" so it doesn't read as contradicting the managed wallet that registration creates.

No references to pre-release names (zero auth signup, top-level zero auth claim, claim polling) — verified by grep.

One deviation from the ticket text: the ~7-day claim TTL is WorkOS dashboard config and isn't confirmable from the repo, so instead of hardcoding a number the skill points at the authoritative deadline the CLI already surfaces (printed at registration and stored as claimTokenExpires).

Skill content is shipped by the plugin, so this bumps all manifests 1.3.3 → 1.4.0 (make minor).

Verification

Command surface checked against the installed @zeroxyz/cli 1.15.0 (zero auth --help, zero auth agent register/claim --help, zero wallet fund --help) and against the ZERO-477 branch source (packages/cli/src/commands/auth-command.ts, devdocs/auth.md).

🤖 Generated with Claude Code

[spencercharest]

Consolidated into #65 (same feature surface, one 1.9.0 release): the skill update lands there merged on top of main's attribution-token changes, with the version bump redone against 1.8.0.