feat(tools): scaffold ruview MCP server + CLI + ADR-104 (#705)

Adds two new npm packages that expose RuView's WiFi-DensePose
sensing capabilities outside the Cognitum appliance ecosystem:

- tools/ruview-mcp/ (@ruv/ruview-mcp) — MCP server with 6 tools:
  ruview_csi_latest, ruview_pose_infer, ruview_count_infer,
  ruview_registry_list, ruview_train_count, ruview_job_status.
  Uses @modelcontextprotocol/sdk with stdio transport.
  6/6 smoke tests pass. TypeScript strict mode, Node 20.

- tools/ruview-cli/ (@ruv/ruview-cli) — Yargs CLI with matching
  subcommands: csi tail, pose infer, count infer, cogs list,
  train count, job status. Same fail-open pattern as the cog
  binaries (WARN to stderr, exit 0 on unavailable sensing-server).

- docs/adr/ADR-104-ruview-mcp-cli-distribution.md — design rationale,
  6-row threat table, packaging plan, acceptance gates, failure modes.

- docs/research/sota-2026-05-22/HORIZON.md — 12-hour horizon plan
  with 7 milestones tracked (M1 complete in this commit).

Both packages are private:true pending the user's publish decision.
Inference is via subprocess to the signed cog binaries (ADR-100/101/103)
— no JS/WASM ML engine bundled.

tools/ruview-cli/src/http.ts

@@ -0,0 +1,53 @@
+/**
+ * Lightweight HTTP client (re-used in CLI commands).
+ * Identical to tools/ruview-mcp/src/http.ts but kept separate to avoid a
+ * workspace dependency — both packages are standalone and independently publishable.
+ */
+
+const REQUEST_TIMEOUT_MS = 10_000;
+
+export type Ok<T> = { ok: true; data: T };
+export type Err = { ok: false; error: string };
+export type Result<T> = Ok<T> | Err;
+
+export function ok<T>(data: T): Ok<T> {
+  return { ok: true, data };
+}
+
+export function err(error: string): Err {
+  return { ok: false, error };
+}
+
+export async function sensingGet<T>(
+  baseUrl: string,
+  path: string,
+  token: string | undefined
+): Promise<Result<T>> {
+  const url = `${baseUrl.replace(/\/$/, "")}${path}`;
+  const headers: Record<string, string> = { Accept: "application/json" };
+  if (token) headers["Authorization"] = `Bearer ${token}`;
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+
+  try {
+    const res = await fetch(url, { headers, signal: controller.signal });
+    clearTimeout(timer);
+    if (!res.ok) {
+      return err(`HTTP ${res.status} from ${url}: ${await res.text().catch(() => "(no body)")}`);
+    }
+    let body: unknown;
+    try {
+      body = await res.json();
+    } catch {
+      return err(`Non-JSON response from ${url}`);
+    }
+    return ok(body as T);
+  } catch (e: unknown) {
+    clearTimeout(timer);
+    if (e instanceof Error && e.name === "AbortError") {
+      return err(`Request to ${url} timed out after ${REQUEST_TIMEOUT_MS}ms`);
+    }
+    return err(`Network error fetching ${url}: ${String(e)}`);
+  }
+}