Close the verified quality gaps in Col MCP (issue #61)#62

Closes #61 — the full quality-gaps plan from the independently re-verified external review, delivered across 7 commits.

What landed

• Install truth. get_component answers with the exact per-component command generated from each registry's documented template (npx shadcn@latest add command, not add button) plus the component's npm and registry dependencies (cmdk, cn, dialog).
• Compatibility truth. Tracked subjects derive per library (no more "Emotion: unknown" on Tailwind libraries), real ranges recorded from npm peer metadata and official docs, and a build-time rule fails when recorded facts contradict a library's own getting-started text (it caught Mantine's stale React 18+ against its v9 peers).
• Component records. kind on all 1435 components (primitives / full patterns / visual effects / layouts), a stacks filter on search_components, shared concept aliases so modal finds every library's dialog, and 1019 one-line summaries taken from each component's own documentation page.
• Search precision. Word/prefix matching with separator folding and de-spaced index variants: cmd k drops from 131 hits to 2, e from 767 to 0, and commandpalette / command-palette / cmd+k / ⌘K all resolve like the spaced form.
• Ranking and attribution. Real search UIs rank above visual effects sharing a word ("spotlight" leads with Mantine Spotlight and shadcn Command), and every hit states what matched (component:, name:, alias:, tag:, description:).
• Self-explaining results. Empty results carry an indexStatus hint and near-miss suggestions, get_library lists the library's recorded components, and shared caveats appear once per response instead of on every hit.
• Freshness. Verification is per field (page / install / compatibility / snapshot) and identical across tools, every record carries verifiedAt (all 1435 re-verified 2026-10-10), source URLs record their variants (radix/base), and scripts/verify-sources.mjs re-checks drift for maintainers.
• Coverage fill. 346 components across the five named empty shells (HeroUI, Flowbite, origin-ui/coss, Kibo UI, Cult UI), plus cmdk and kbar as first-class entries with npm-verified facts.
• Docs corpus (item 7). Reuse permissions recorded registry-wide from the licensing audit — 64 granted with each library's verified license source, Aceternity denied per its own license, and undecided libraries carry no entry by design. 58 documentation snapshots hold install/usage evidence with fetch dates and the git SHA each page documented; thin landing pages earn no snapshot.

Verification

• CoVe acceptance gate: 18/18 re-verified against the live tool layer after the final commit.
• npm test 103/103 green, npx tsc --noEmit clean.
• Every component URL fetched live during ingestion: zero dead on arrival, 78 HeroUI canonical-URL drifts corrected.
• The licensing audit was re-checked at source (LICENSE files, license pages, npm peer metadata), including the MIT + Commons Clause family (react-bits, rare-ui, Nexvyn) where docs reuse with attribution is permitted while component redistribution is not.

Remaining, deliberately optional

A handful of libraries document only on JS-rendered sites that serve nothing to a fetcher; their permission records are in place for when the content becomes reachable. Same for ~400 component one-liners. Nothing here blocks the acceptance criteria.