chore(cli): improve dry-run test fixture and 403 error message

- Fix test fixture: warnings-only response now uses valid=false to
  match real backend behavior (warnings make dry-run invalid)
- Distinguish 403 from 401 in CLI error messages: 403 now says
  "access denied — token may lack required scope" with a hint to
  regenerate the token, rather than the generic "authentication failed"

cli/src/clients/skillhub-client.ts

@@ -151,9 +151,12 @@ export class SkillHubClient {
   }
 
   private async handleJsonResponse<T>(response: Response): Promise<T> {
-    if (response.status === 401 || response.status === 403) {
+    if (response.status === 401) {
       throw new CliError('authentication failed', EXIT.auth, { registry: this.registry, next: 'run `skillhub login`' })
     }
+    if (response.status === 403) {
+      throw new CliError('access denied — token may lack required scope', EXIT.auth, { registry: this.registry, next: 'regenerate token with required scopes or run `skillhub login`' })
+    }
     if (response.status === 404) {
       throw new CliError('resource not found', EXIT.generic, { registry: this.registry })
     }

cli/test/integration/publish-dry-run.test.ts

@@ -50,12 +50,12 @@ describe('publish --dry-run', () => {
     expect(registry.received.publish).toBeNull()
   })
 
-  test('--dry-run with --json returns structured response', async () => {
+  test('--dry-run with --json returns structured response on warnings (valid=false)', async () => {
     const env = await createTempHome()
     registry = await startFakeRegistry({
       token: 'sk_ok',
       dryRunResponse: {
-        valid: true,
+        valid: false,
         errors: [],
         warnings: ['Disallowed file extension: data.bin'],
         resolvedSlug: 'my-skill',
@@ -70,9 +70,9 @@ describe('publish --dry-run', () => {
       USERPROFILE: env.home
     })
 
-    expect(result.exitCode).toBe(0)
+    expect(result.exitCode).toBe(6)
     const json = JSON.parse(result.stdout)
-    expect(json.valid).toBe(true)
+    expect(json.valid).toBe(false)
     expect(json.resolvedSlug).toBe('my-skill')
     expect(json.resolvedVersion).toBe('2.0.0')
     expect(json.warnings).toContain('Disallowed file extension: data.bin')