fix(cli): harden config prime-agent sync + install /mcpctl switcher extension

Addresses a review of the `config prime-agent` feature and adds the in-app
project switcher.

Safety/correctness fixes (prime-agent's shared, hand-editable ~/.prime/agent
tree must never suffer silent data loss):
- config/prime-agent.ts: loadPrimeAgentSettings now fails loudly on corrupt
  JSON instead of swallowing it and rewriting the file (which destroyed every
  non-mcpServers setting). A project's mcpServers entry is merged (keeping
  user-added fields) rather than replaced wholesale. Added writePrimeAgentAuth
  / hasPrimeAgentAuth helpers for auth provisioning.
- skills sync: unified the near-verbatim prime-agent copy into runSkillsSync
  via a `target: 'claude' | 'prime-agent'` option (prime-agent-skills.ts is now
  a thin wrapper). Under the prime-agent target it: preserves untracked
  pre-existing skill dirs on first sync (no more rm -rf of hand-authored `sre`),
  records per-project ownership so configuring a second project never deletes
  the first project's skills, skips Claude-only hooks/postInstall, and keeps
  the mcpServers auto-attach step.
- config.ts: `config prime-agent` now (a) provisions the bearer credential in
  auth.json (--token, existing entry, or auto-mint via POST /api/v1/mcptokens),
  (b) writes the .mcpctl-project marker only when none exists up-tree and never
  from $HOME, and (c) propagates the skills sync exit code so auth failures are
  reported instead of swallowing them.
- skills.ts: `--agent` is validated; an unknown value errors instead of
  silently running the Claude sync.

New feature: `config prime-agent` installs a `/mcpctl` project-switcher
extension into ~/.prime/agent/extensions/ (skip with --skip-extension). It lists
mcpctl projects via `mcpctl get projects -o json`, lets you pick one from the
prime-agent TUI, applies the switch through the CLI, and reloads the session.

Regenerated shell completions. Tests: 538 pass (new coverage for settings
corruption, entry merge, auth provisioning, extension install/skip, marker
$HOME handling, untracked/cross-project skill preservation, --agent validation).

README.md

@@ -127,10 +127,18 @@ This:
 
 1. Registers the proxy MCP gateway in `~/.prime/agent/settings.json` as
    `mcpServers.monitoring = { "type": "http", "url": "https://mcp.ad.itaz.eu/projects/monitoring/mcp" }`
-   (merging with any existing servers — the bundled `sre` project is preserved).
-2. Writes a `.mcpctl-project` marker so later syncs resolve the project.
-3. Syncs the project's skills into `~/.prime/agent/skills/<name>/` as markdown
-   skills (prime-agent auto-discovers them at session start).
+   (merging with any existing servers and preserving all other settings).
+2. Provisions the project's bearer credential in `~/.prime/agent/auth.json`
+   (`mcp:monitoring`) — either from `--token <pat>`, an existing entry, or an
+   auto-minted project token.
+3. Writes a `.mcpctl-project` marker (only if none exists higher up, and never
+   from `$HOME`) so later syncs resolve the project.
+4. Syncs the project's skills into `~/.prime/agent/skills/<name>/` as markdown
+   skills. The shared tree is ownership-tracked per project: it never deletes
+   another project's skills or an untracked hand-authored skill.
+5. Installs a `/mcpctl` project-switcher extension into
+   `~/.prime/agent/extensions/` so you can switch mcpctl projects from inside
+   the prime-agent UI (skip with `--skip-extension`).
 
 Re-sync later with:
 
@@ -138,6 +146,14 @@ Re-sync later with:
 mcpctl skills sync --agent prime-agent --project monitoring
 ```
 
+Skip individual steps as needed:
+
+```bash
+mcpctl config prime-agent --project monitoring --token mcpctl_pat_xxx   # provide token, don't mint
+mcpctl config prime-agent --project monitoring --skip-skills            # don't sync skills
+mcpctl config prime-agent --project monitoring --skip-extension         # don't install /mcpctl switcher
+```
+
 Preview the change without writing anything:
 
 ```bash