fix(installer): stop duplicating agent instructions; MCP server is the single source of truth (#529)

[colbymchenry]

Summary

Closes #529.

The installer wrote a ## CodeGraph usage block into each agent's instructions file (CLAUDE.md, AGENTS.md, GEMINI.md, Cursor .cursor/rules/codegraph.mdc, Kiro steering doc) that duplicated — almost verbatim — the guidance the MCP server already emits in its initialize response. Agents that surface MCP instructions (Claude Code does) read the same playbook twice every turn. The MCP server instructions are now the single source of truth.

What changed

• All 6 instruction-writing targets (claude, cursor, codex, opencode, gemini, kiro) stop writing the block. (Hermes and Antigravity never wrote one.)
• Self-heal: install now strips a block a previous version wrote (uninstall already did). So the next codegraph install / codegraph uninstall cleans up an existing install — re-install always runs the strip (no "already configured, skip" early-return). Simply upgrading the npm package does not trigger it (the shim is a launcher with no postinstall); the leftover block is harmless (just redundant) until the user re-runs the installer.
• server-instructions.ts is the single source of truth. Ported the two steers that were unique to the old template: the explicit "trust codegraph — don't re-verify with grep" anti-pattern and the not-initialized → codegraph init -i hint.
• Dead code removed: INSTRUCTIONS_TEMPLATE / CLAUDE_MD_TEMPLATE, claude-md-template.ts, writeClaudeMd / hasClaudeMdSection, and the Cursor-only wireProjectSurfaces bootstrap (its only job was writing the rules file). instructions-template.ts keeps just the markers needed to find/strip legacy blocks. The install log learned a Removed verb.
• The "update all three" house rule collapses to edit server-instructions.ts and nowhere else.

Tests

• Rewrote the instruction-specific installer tests to the new contract (install does not write; install + uninstall self-heal) and added self-heal coverage for both mechanisms (marker-strip for shared files, file-delete for Cursor .mdc / Kiro steering). 140/140 installer tests pass.
• Full suite green except the 5 pre-existing npm-shim download tests, which fail identically on main (local-HTTPS/environment, unrelated).
• tsc --noEmit clean, npm run build clean.

🤖 Generated with Claude Code