fix: make dv-connect work on npx and JetBrains-registry installs

[arorashivam96]

Summary

Makes dv-connect work when the plugin is installed as skill folders only -- via npx skills add or the JetBrains AI Assistant registry, the path PyCharm / Rider users take. Marketplace / native-plugin installs are unaffected.

Context & design (JetBrains distribution)

The problem. A skill plugin can be installed two ways: as a native / marketplace plugin (ships everything, including helper scripts), or as skill folders only -- npx skills add or the JetBrains AI Assistant registry, which copy just the SKILL.md + references/ trees. JetBrains PyCharm / Rider users take the skill-folder path. Our skills assumed the first model, so on the second they were missing the shared helper scripts and couldn't resolve their own version -- dv-connect failed and telemetry reported unknown. This PR makes the skill-folder path a first-class, fully working install (internally: A1).

Canonical source, resolved at runtime (not duplicated). The nine dv-* skills and their two shared helpers (auth.py, enable-mcp-client.py) have one home: .github/plugins/dataverse/ -- skills under skills/, helpers at the plugin root scripts/ (a single copy, shared by six skills). We deliberately did not duplicate the scripts into each skill or project a root-level skills/ / scripts/ tree. Instead dv-connect copies-or-fetches the helpers at connect time: use the local copy in a source clone, else fetch from the canonical raw GitHub URL on main. One source of truth; the scripts (which carry telemetry attribution) always resolve to the current canonical version.

Version resolution is fail-open. Attribution is app=dataverse-skills/<version>;skill=<skill>;agent=<agent>. <version> comes from DATAVERSE_PLUGIN_VERSION, which dv-connect writes to .env; on a bare skill-folder install that var is absent, so auth.py falls back to reading the canonical plugin.json (local if present, else fetched once and cached). If every source fails it degrades to unknown rather than raising -- attribution must never block a data operation.

MCP pre-warm before restart. The stdio MCP proxy authenticates by reading the shared MSAL token cache. Registering the server usually requires an editor restart, after which the proxy must authenticate with no UI. The new runbook warms the cache, allowlists the client, and validates the GA /api/mcp endpoint before the restart, so the first post-restart call succeeds silently.

One-command install. npx skills add microsoft/Dataverse-skills -s "*" installs all nine skills and prompts for the target agent; -g installs globally across every project. This is the discoverable entry point for any agent, JetBrains included.

Next step -- A2-lite (catalog listing). The forward step is to list dv-* in the official JetBrains skills catalog (a curated, JetBrains-verified snapshot) for first-class discoverability, plus a best-effort host=jetbrains telemetry signal -- without building an IDE plugin. Design decision: contribute a full snapshot of all nine skills (flat top-level dirs, each with metadata.source back to canonical), not a single "bootstrap" skill that pulls the rest at runtime. Rationale: routing between skills is by skill name, so flattening is safe and all nine must be present for routing to work the moment they land; the shared scripts still resolve via dv-connect's canonical fetch -- the same mechanism this PR adds. A single-bootstrap model would break first-run routing (the agent needs dv-overview before the bootstrap could install it) and adds a runtime-clone failure mode.

What changed

• dv-connect copies-or-fetches auth.py + enable-mcp-client.py from canonical when they aren't local, so npx / registry installs (which ship no scripts) work. Steps in references/helper-scripts.md.
• scripts/auth.py resolves the telemetry version from the canonical plugin.json when DATAVERSE_PLUGIN_VERSION is unset/unknown -- fixes app=dataverse-skills/unknown. Keeps fix: complete plugin telemetry attribution (dv-connect, notebook, CLI eval) #139's fail-open validation.
• references/mcp-configuration.md adds the pre-warm-before-restart runbook.
• README.md documents the one-command install (npx skills add microsoft/Dataverse-skills -s "*", -g for all projects).

Validation

Static checks, 54 auth tests, and version-bump all pass. Verified end-to-end in PyCharm: Codex connected (device-code), both scripts fetched into scripts/, records returned, attribution correct (agent=codex).

Notes

Merged latest main (#139 telemetry, #141 Gemini/Antigravity). Version bumped to 1.16.0 (all 9 fields). No change to the other eight skills or to marketplace installs.