augur: the tier-2 surface — skills, MCP, composites, and more than one example

[lex00]

Follow-up to #2357, which landed the augur lexicon at 23/23 tier-1 checks. Its tier-2 and tier-3 surface is thinner than the house bar, and this issue tracks the gaps rather than leaving them as unnamed absences. Nothing here is in KNOWN_FAILURES in scripts/check-lexicons.ts, because that gate is tier-1 only and augur has no tier-1 failure to track.

What is missing, and which of it is real

chant dev check-lexicon lexicons/augur reports 6/17 tier-2 and 2/9 tier-3. Sorted by whether the gap is worth closing:

Worth closing.

• skills() — augur has something to teach an agent that no other lexicon does: how to read a coverage table's three states, and why a refusal is not a zero. Three skills is the tier-2 bar.
• More than one example. examples/getting-started is an aws estate plus two profiles. A k8s one would exercise the other half of the coverage table, whose dotted sizeProp paths (spec.template.spec.containers) are currently only covered by unit tests.
• initTemplates — chant init has nothing to scaffold for augur beyond the default.

Deliberately absent, and #2357 says so in src/plugin.ts.

• mcpTools() / mcpResources(). createDiffTool diffs one build's serializer output against the last, and augur's output is a list of questions rather than an estate; createCatalogResource serves the generated resource registry, and augur generates none. Declaring either returning [] would pass a check while contributing nothing — the defect terraform: record acceptance evidence in-tree, stop passing completeness checks on TODO stubs, and fix the lineage record #2220 removed from terraform.
• src/composites/. A composite bundles several resources into one declaration. augur declares one resource with two properties.
• validate.ts requiring 30 names. There are no generated names to require; the registry is {} on purpose.

Needs a decision.

• roundtrip.test.ts and typecheck.test.ts. Neither has an obvious meaning for a lexicon whose artifact is a request rather than a substrate document, and inventing one to pass a check is the failure mode this bar exists to catch.

Also here: the URL transport

src/engine.ts dials a command on PATH and refuses a URL by name. That is deliberate — an HTTP shape belongs to #2359's first engine adapter, and guessing one in #2357 would have handed that issue a decision already made badly. When #2359 lands, defaultConnect should route a URL at it, and the refusal text naming #2359 should go.

Refs #2355, #2357, #2359.