fix(providers): cut per-call cost of CLI-provider scans

[rng1995]

Why

A user on r/ClaudeAI (thread) asked Claude Code to scan their 15 skills with SkillSpector. The agent picked claude_cli on its own and ran five scans in parallel. Because every LLM call starts a separate claude -p session, that came to 434 sessions in about 6 minutes, 22.4M tokens (about 34k of startup context per session, on Opus), and 98% of their 5-hour plan window. It also left 1,144 folders in ~/.claude/projects.

#298 (for #295) already keeps MCP servers, hooks, and settings out of the child. Three costs were still left: the built-in tool schemas, Claude Code's default agent system prompt, and a persisted transcript for every call.

Changes

1. Lower per-call cost (claude argv). Add --tools "", so the built-in tool definitions are no longer sent. --allowed-tools "" only blocks tool use (CLI reference). Also replace the default system prompt with a short fixed one via --system-prompt; the analyzer instructions still arrive on stdin.
2. No session clutter. Add --no-session-persistence. Each call runs in a fresh temp cwd, so before this change every call left its own project folder.
3. Smaller default fan-out and a warning. When SKILLSPECTOR_MAX_LLM_CONCURRENCY is unset and the active provider is a CLI provider, the default is now 2 instead of 10. Once per process, when a CLI provider is available, SkillSpector warns that every LLM call is a separate session on the user's plan and points to --no-llm.
4. skill-inspector guidance. Keep --no-llm unless the user asks for LLM analysis. Never choose or change SKILLSPECTOR_PROVIDER without asking. Don't run CLI-provider scans in parallel.

Not in this PR

• Printing the expected number of LLM calls before a scan, or asking the user to confirm. The call count isn't known up front, and a prompt would break non-interactive runs. The warning plus the lower default cover the immediate risk.
• A README section on CLI-provider cost.

Testing

• uv run python -m pytest tests/unit/test_agent_cli.py tests/unit/test_providers.py tests/nodes/test_llm_analyzer_base.py: 539 passed, 10 skipped. New tests cover the argv flags, the CLI concurrency default (and that an explicit value still wins), and the warn-once behaviour.
• ruff check and ruff format --check are clean.
• The new flags were checked against the current Claude Code CLI reference, not run against a live claude binary. Before merge, a maintainer with claude installed should run one SKILLSPECTOR_PROVIDER=claude_cli scan to confirm that auth still works and the output parses. Older claude builds that lack --tools or --no-session-persistence will fail closed with a non-zero exit.

🤖 Generated with Claude Code