feat(cli): parallel catalog validation and fleet rollup

[mimran-khan]

Fixes #122
Related: #120, #121

This branch includes two catalog features that stack cleanly:

1. catalog-summary.json ([FEA]: Machine-readable catalog fleet rollup report #120 / feat(cli): write catalog-summary.json after catalog validate #121): fleet rollup after catalog validate
2. --workers N ([FEA]: Parallel catalog validation with --workers #122): parallel child-process validation for catalogs

--workers defaults to 1 (serial, same per-skill pipeline view as today). Above 1, skills validate in isolated processes with per-skill output dirs under -o. The parent Click context (or sys.argv when launched from the real CLI) is used to rebuild each child validate invocation, so pytest and production entry points both work.

Parallel mode skips the per-skill Rich pipeline view and prints a single fleet scoreboard at the end. Exit code stays nonzero if any skill failed.

If #121 lands first, I can rebase this to workers-only; happy to split either way.

Test plan

• pytest tests/test_commands.py -k catalog
• Serial catalog tests still pass with --workers 1 (default)
• --workers 2 integration test on two fixture skills

[mimran-khan]

Worker argv, stale JSON, atomic summary, and --include-skills fixes are pushed. Ready for re-review.

[chrisknvidia]

@mimran-khan : Re-reviewed at current head a7ea2e7:

1. Still broken: real CLI worker argv drops option values. _catalog_child_argv_from_sys() now discards every non-flag token, including values such as schema, 95, model names, and paths. A real console run of skillevaluator validate <catalog> --workers 2 --no-llm --no-dedup --checks schema -o <out> exits 1 and reports 0/1 passed. The new CliRunner test passes because it exercises _catalog_child_argv_from_ctx(), not the production sys.argv path.
2. Still broken: stale JSON is reused when no new JSON is produced. _run_catalog_skill_worker() returns json_report_name=None, but _catalog_skill_entry() treats None as permission to call _latest_skill_json_report(); serial mode also still scans existing output. Reusing -o reproduced current passed: false / reason: validation failed alongside stale overall_passed: true, overall_status: passed, and old severity counts.

The atomic summary writer and --include-skills fixes were independently verified.

[rng1995]

Parallel catalog execution still loses real CLI option values, changes explicit CLI-only reporting, and can reuse stale per-skill JSON after a worker produces no report. Focused catalog tests and Ruff/diff checks passed; the single Python 3.12 CI failure is an unrelated flaky NVIDIA bridge socket test. Requesting changes for the reproducible worker-boundary defects in the review threads.

[rng1995]

[P1] Remove the module-global report handoff. The required Python 3.12 job deterministically fails here and at line 348 because Ruff reports PLW0603; process-global state also makes nested or re-entrant validate calls share provenance. Please return the emitted JSON basename through the Click invocation and worker result, or store it in invocation-scoped context state, instead of mutating _last_validate_json_report.

[rng1995]

The previously reported worker argument, report-format, stale-report, SARIF-selection, and same-second overwrite defects are fixed at the current head, and all 53 focused command tests pass. Required CI is still red: Ruff rejects the new module-global report handoff, and DCO reports fb87d4a and 21cdb16 as unsigned. Please replace the global with invocation-scoped state, fix the sign-offs, and rerun the checks.

[mimran-khan]

Same ContextVar handoff as #121 at 184a95c, merged with main. Parallel workers consume the report name from the child validate context without a process-wide slot. Same-second JSON overwrite fix and exact basename binding are unchanged. Ready for re-review when CI runs on your side.