[kivtxs]

A fresh export of CLI#103 (chore/pin-cli-0.3.1, commit 53b2ebe, on top of the 0.3.1 release PR CLI#102). It supersedes #8.

• Every launcher and client snippet pins @offline-protocol/cli@0.3.1. The plugin is 0.1.5. The MCP Registry records are cli 0.3.1 and hosted 0.3.1.
• The bundled skill (build-with-offline-protocol) covers:
  • setting up the developer's application without the portal (the local MCP account tools and offline apps … / offline apply, from CLI 0.3.0);
  • native app attestation: register every app, pass attestation providers (Expo: createExpoAppIntegrityProviders + entitlement; bare React Native: the starters' native module), development mode for simulators, emulators and Expo Go (refused for production apps), and which Android chains are degraded and which are refused (untrusted_chain);
  • the registry pins id-react 0.3.0 / id-react-native 0.4.0, where sendCode throws OfflineIdError with nextSteps instead of resolving to false.
• SOURCE.json records the source commit and a sha256 for every file.

Do not merge before

1. CLI#102 merged and v0.3.1 published on npm (every launcher here runs npx -y @offline-protocol/cli@0.3.1; before that it fails with ETARGET).
2. CLI#103 merged. If it is merged with a merge commit, 53b2ebe stays in main's history and this export stays valid. If it is squashed, re-export from the squash commit: node scripts/export-agent-plugins.mjs --out <dir> --check-npm, copy over this branch, push.

Then smoke the published package the same way as 0.2.9: offline --version, mcp serve tool list, get_package @offline-protocol/id-react-native returns 0.4.0, a react-native-id-only scaffold pins ^0.4.0.

How this was checked

• node scripts/export-agent-plugins.mjs --out … passed its secret, path and pin checks (--check-npm is left for after the release, since 0.3.1 is not on npm yet).
• --check confirms this branch matches the export of 53b2ebe94352900ec485ac1ba7d2eb5024c1e04f (36 files).
• In the CLI: check-agent-distribution (manifests, marketplace paths, editor links, registry records) and check-guidance pass on c98975a; 53b2ebe adds only a starter README change outside the export, so the exported files are identical apart from SOURCE.json.