feat(status): show tier + expiry date in recover.sh status output

[saurabhjain1592]

Summary

V1 SaaS Plugin Pro tier-line surface parity (#1886 sub-item, Session E4 of the V1 launch). The scripts/recover.sh status output's tier line now parses the JWT exp claim from the configured Pro license token and renders one of three shapes:

• tier Pro tier active (expires 2026-08-03, 90 days remaining) — paid Pro tier active
• tier Free tier (Pro expired 2026-02-04 — visit https://getaxonflow.com/pro to renew) — token configured but its exp is in the past (the plugin will not forward an expired token)
• tier Free tier (no AXON- license token configured) — no token loaded
• Fallback for unparseable tokens: tier Pro tier active (expires UNKNOWN — could not parse token)

The leading Pro tier active / Free tier substrings are preserved so existing runtime-e2e/v1-paid-tier/test.sh assertions (which grep for those exact substrings) keep passing without modification — this is an additive extension, not a breaking change to the line shape.

Updates skills/pro-tier-status/SKILL.md to document the three new shapes and the renew workflow.

Display only — JWT signature validation remains the platform's job.

Self-review (5-question protocol per hunk)

Walked every hunk against (a) commit message accuracy, (b) template / boilerplate residue, (c) env / secret / path correctness, (d) tests exercise the claimed behavior, (e) byte-shippable to a customer.

• scripts/recover.sh — added extract_jwt_exp() + format_unix_to_date() helpers (portable base64 -d / -D, date -d @<epoch> / -r <epoch>); extended cmd_status() with the three-branch tier-line resolution. Token redaction posture preserved (last 4 chars only via ${AXONFLOW_LICENSE_TOKEN_RESOLVED: -4}). Pro-expired branch prints an inline help block AHEAD of the existing upgrade-CTA block so the user sees the renew prompt prominently. Added a new pro_expired_flag local var that gates the inline block.
• skills/pro-tier-status/SKILL.md — extended description to include "when does my Pro license expire?" trigger, added "Tier line shape" section listing the four shapes, added "Renewal + upgrade path" section. All bash $PLUGIN_DIR/scripts/recover.sh status references preserved verbatim.
• runtime-e2e/v1-paid-tier/test.sh — added Test 6f covering the 3 new shapes. Pre-existing 6a/6b/6c/6d/6e assertions preserved unchanged (still grep for Free tier / Pro tier active substrings — the new line shapes contain them).
• CHANGELOG.md — single Unreleased entry under "Changed" (extending the existing recover.sh status entry), no version bump.

Test plan

CI:

• ci.yml — shellcheck + script tests (matrix bash 5)
• install-smoke.yml — exercises the staged plugin end-to-end
• definition-of-done.yml (HARD RULE #0 gate)

Local runtime evidence (3 cases, captured against this PR's branch):

=== FREE ===
AxonFlow Codex plugin — status

  endpoint           https://try.getaxonflow.com
  tenant_id          (not registered yet — first agent call will auto-register, or run `scripts/recover.sh request`)
  config file        .../axonflow.toml (present=no)
  license token      unset
  tier               Free tier (no AXON- license token configured)
  upgrade            https://getaxonflow.com/pro

To upgrade to Pro ($9.99 one-time), copy your tenant_id above, then visit
https://getaxonflow.com/pro, paste the tenant_id into the "Your AxonFlow tenant ID" field,
...

=== PRO ACTIVE ===
AxonFlow Codex plugin — status

  endpoint           https://try.getaxonflow.com
  tenant_id          (not registered yet ...)
  config file        .../axonflow.toml (present=no)
  license token      set (AXON-...g-pa)
  tier               Pro tier active (expires 2026-08-03, 90 days remaining)
  upgrade            https://getaxonflow.com/pro
...

=== PRO EXPIRED ===
AxonFlow Codex plugin — status

  endpoint           https://try.getaxonflow.com
  tenant_id          (not registered yet ...)
  config file        .../axonflow.toml (present=no)
  license token      set (AXON-...g-pa)
  tier               Free tier (Pro expired 2026-02-04 — visit https://getaxonflow.com/pro to renew)
  upgrade            https://getaxonflow.com/pro

Your Pro license token is on disk but its 'exp' has passed; the plugin will
not forward an expired token. After buying a renewal, replace the token via:
  AXONFLOW_LICENSE_TOKEN=AXON-... codex …
or persist with:
  scripts/recover.sh apply-token
...

runtime-e2e/v1-paid-tier/test.sh locally: 17 PASS / 0 FAIL (Test 8 live-agent step skipped — no agent at localhost:8080 in this env, which is the documented fallback).

Notes for the orchestrator

• No version bump. No package.json / plugin.json changes — code merge only per feedback_releases_require_approval.md.
• No release prep. No tag, no GitHub release. Orchestrator handles release approval gating.
• Sister PRs land in parallel for tier-line surface parity across claude / cursor / openclaw.