Prepare for tinycloud 0.3.20: playable Slack unfurls + entity search (skill floor → 0.3.20) - #29

Summary

Prepares the distribution surfaces for tinycloud 0.3.20 (SDK 0.7.24), which adds playable Slack unfurls and entity search (features 42→45, verbs stay 17). npm launcher version → 0.3.20 (1:1 with the binary).

What 0.3.20 adds (and the skill now teaches)

Playable Slack unfurls (feature publish.link.preview.player.v1):

• --link-preview on publish / publish video gains a player level: the pasted link unfurls in Slack with an inline player via the Cloudglue Slack app (implies the full card).
• A private share plays itself; a site plays the hero share set with the new site-only --preview-share <share-id> flag (requires --link-preview player; "" clears; without a hero the unfurl stays card-only; reported as data.preview_share_id and link-preview=player hero=<id> in publish list).
• Unlike full, player matters on both site visibilities (a public site's hero must be a public share); public shares already unfurl playable with no flag.
• Private content plays only in Slack workspaces the account owner connected in the Cloudglue dashboard — and anyone who can see the Slack message can play it, so the skill teaches asking the user before opting private content in. Downgrading to full/none revokes playback in already-posted unfurls.

Entity search + auto scope (features probe.entities.v1, probe.scope.auto.v1):

• entities collections are first-class probe/ask targets — extractions are indexed into search documents for free (tinycloud-created entities collections are segment-level by default → segment hits with real timestamps).
• Omitting --scope is now AUTO (the search picks the right level, so probing no longer requires knowing the collection's type); explicit scopes still force a level.
• collections show file rows gain searchable_status — the metadata/entity search-index readiness signal, distinct from the enrichment status.

Changes here

• skills/tinycloud/tinycloud-skill.json: min_version 0.3.18 → 0.3.20, supported_range >=0.3.20 <0.4.0, required_features +3 (probe.entities.v1, probe.scope.auto.v1, publish.link.preview.player.v1)
• skills/tinycloud/scripts/preflight.sh: MIN_VERSION + REQUIRED_FEATURES kept identical to the manifest (CI sync check passes)
• skills/tinycloud/SKILL.md + reference/verbs.md: cheat sheet, probe/ask/collections/publish sections teach the new surface with the ask-the-user-first caveats
• package.json: 0.3.19 → 0.3.20
• CLAUDE.md: records the 0.3.20 release

Merge gate

Same pattern as the 0.3.14–0.3.18 floor raises: merge only after the CDN serves 0.3.20 (channels.stable = 0.3.20 with pinned tarballs + manifest + sidecars), so the raised preflight floor never points at a binary users can't install. Until then the live-CDN legs would fail — they run on push to main, not on this PR.

Test plan

• npm test — 42/42 against the offline fixture CDN
• TINYCLOUD_TEST_TARBALL=<real 0.3.20 darwin-arm64 tarball> npm test — 42/42 (launcher verifies/caches/execs the real new binary)
• scripts/smoke-test.sh with EXPECTED_VERSION=0.3.20 against the extracted binary — all pass
• skills/tinycloud/scripts/preflight.sh exits 0 against the 0.3.20 binary (all 34 required feature ids present); exits 11 against an older binary (floor enforced)
• shellcheck install.sh scripts/smoke-test.sh skills/tinycloud/scripts/preflight.sh clean
• claude plugin validate . passes
• Local run of the CI feature-sync check: manifest and preflight identical (34 features, range >=0.3.20 <0.4.0)