fix: preserve YAML comments/order in capa add (#93) and pointer cursor on buttons (#92)

[Minitour]

Summary

Fixes the two most severe open bugs:

• [Bug] Running capa add rearranges the yaml file #93 (data loss): capa add re-serialized the entire capabilities.yaml through js-yaml's dump(), which deleted user comments and rearranged keys. Introduces a comment-preserving appendCapabilityEntry() (backed by the round-trip yaml parser) and routes every capa add write path (registry skill/plugin, --plugin, default skill) through it. New entries are appended in place; the rest of the file is left byte-for-byte intact. JSON files keep their existing parse/stringify path.
• [Bug] Buttons don't appear as clickable in the UI #92 (UX): Interactive elements in the web UI didn't show a pointer cursor on hover. Adds a global base-layer rule giving button/[role=button]/label[for]/summary cursor: pointer, and not-allowed when disabled — covering all buttons since there's no shared Button component.

Changes

• src/shared/capabilities.ts — new appendCapabilityEntry() using yaml parseDocument for round-trip preservation.
• src/cli/commands/add.ts — all write sites now append in place instead of full re-dump.
• web-ui/src/index.css — global cursor rules for interactive elements.
• Added yaml dependency.

Test plan

• New unit tests in capabilities.test.ts assert comments + key order survive, missing sections are created, and JSON append works.
• Full suite: bun test → 1019 pass / 0 fail.
• Typecheck: bunx tsc --noEmit clean.
• bun run build:web succeeds (CSS compiles).
• Manual: hover buttons in the local UI to confirm pointer cursor.

🤖 Generated with Claude Code