fix(setup): install the Alexandria skill with the core skills

[nickscamara]

Problem

firecrawl-alexandria lives in skills/ and is mirrored to firecrawl/skills under skills/core/, but it isn't in CLI_SKILLS. So firecrawl init and firecrawl setup core never install it. The firecrawl, firecrawl-search and firecrawl-scrape skills all link to ../firecrawl-alexandria/SKILL.md for Alexandria feedback, and on a user's machine that link points to nothing.

That skill is the only place that tells a CLI agent to send firecrawl alexandria feedback, explains the 1-credit refund, and describes the feedback fields. CLI agents send many feedback reports per team but have the highest bad share of any surface, so the coverage signal from the CLI is thinner than it should be.

firecrawl setup alexandria was broken too. It installs from ../../beta-skills, which #271 deleted, and that folder was never part of the npm files list anyway.

Change

• Add firecrawl-alexandria to CLI_SKILLS, so init and setup core install it next to the search/scrape skills that point to it.
• Remove the internal setup alexandria command (it installed from the deleted beta-skills/). firecrawl-alexandria now ships with the core skills instead.
• installSkills now runs npx skills add through runClientCommand (argv, with no shell on POSIX and escaped cmd.exe arguments on Windows) instead of execSync(args.join(' ')). It also passes --agent to the native no-npx fallback. This applies to setup core/build/workflows/<skill> too, which share this path. A test checks that a hostile --agent value reaches npx as a single argument.
• Update the setup tests and the README line about what the core skills cover.

This overlaps with the stale #226 (move from beta-skills/ to skills/). That move already shipped in #271, but the install wiring didn't come with it. firecrawl init has its own execSync skills path, which this PR leaves alone.

[cubic-dev-ai]

All reported issues were addressed across 4 files

<sub>Shadow auto-approve: would not auto-approve because issues were found.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would auto-approve. Fixes firecrawl setup so the Alexandria skill installs with the default core skills, routes setup alexandria through the normal catalog installer instead of the deleted beta-skills path, and hardens npx invocation to use argv; tests cover the new behavior.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 2 files (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would auto-approve. Fixes setup so the Alexandria skill installs with the core CLI skill set, routes setup alexandria through the normal catalog installer, and hardens npx invocation to use argv; tests pin the corrected behavior.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Shadow auto-approve: would not auto-approve because issues were found.
Tip: Review your code locally with the cubic CLI to iterate faster.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would auto-approve. Fixes CLI skill setup so firecrawl-alexandria ships with the core set, removes the broken setup alexandria path, and invokes npx via argv without a shell; tests pin the corrected behavior.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>