feat: glassflow-connect-agent onboarding skill

[sudopower]

Summary

• Adds a Claude Code plugin (glassflow-connect-agent) that walks a developer from zero to their first real trace in one command: checks org role, mints an API key (or asks for one if not admin), installs glassflow-ai, writes .env, detects the entrypoint (AGENTS.md/CLAUDE.md first, then a heuristic), patches it with glassflow.init() + @observe, runs the agent, verifies a trace arrived via list_agent_traces, and hands off a UI link plus example MCP prompts.
• Depends on the companion create_api_key MCP tool (glassflow/argus-mcp#9).
• Adds two sample agent repos under examples/ used to verify the entrypoint-detection paths (heuristic fallback vs. AGENTS.md-named entrypoint).
• Adds a README section documenting how to install and invoke the plugin.

Test plan

• Manual walkthroughs of every path (admin mint, non-admin/manual key, org-less stop, existing-key re-run) against the two sample repos
• Confirmed real claude plugin marketplace add / install / list / details succeed against this plugin structure
• True end-to-end trace arrival (SKILL.md step 9)

[sudopower]

E2E verification (real dev cluster, real Auth0, real ClickHouse pipeline)

Ran a full live end-to-end test against a fresh kiran namespace on do-ams3-glassflow-dev-cluster, installing this SDK branch directly (pip install git+https://github.com/glassflow/glassflow-python.git@kiran/gla2-218-connect-agent-skill) alongside the companion MCP tool (glassflow/argus-mcp#9, built as rc-PR-9):

• Real Auth0 browser login through the MCP server; create_api_key mints a real, working key.
• SDK's glassflow.init() + @observe instrument a small sample agent (mirroring examples/connect-agent-smoke/).
• Confirmed spans only actually export on explicit client.flush()/shutdown() — a short-lived script exits before the batch processor's timer fires otherwise. Worth calling out in SDK docs/examples for anyone instrumenting a short script rather than a long-running process, since the connect-agent skill's own sample scripts should account for this in the "run it" step.
• Once flushed, spans land end-to-end: receiver → MinIO → NATS → sink → ClickHouse, and are visible via list_agent_traces/get_agent_trace on the MCP side.

One unrelated infra issue found and fixed along the way: the shared ClickHouse PVC was 100% full, blocking writes for every dev namespace. Resized 10Gi → 20Gi and confirmed writes succeed afterward — not something this PR needs to address, just noting it didn't originate here.

No code changes needed as a result of this test — confirms the SDK works correctly against the real backend contract end to end.