feat(status): show tier + expiry date in scripts/status.sh output

[saurabhjain1592]

Summary

V1 SaaS Plugin Pro tier-line surface parity (#1886 sub-item, Session E4 of the V1 launch). The scripts/status.sh output's tier line now parses the JWT exp claim from the configured Pro license token and renders one of three shapes:

• tier Pro (expires 2026-08-03, 90 days remaining) — paid Pro tier active
• tier Free (Pro expired 2026-02-04 — visit https://getaxonflow.com/pro to renew) — token configured but its exp is in the past (the plugin will not forward an expired token)
• tier Free (no Pro license configured) — no token loaded
• Fallback for unparseable tokens: tier Pro (expires UNKNOWN — could not parse token)

The standalone upgrade line is now suppressed for active-Pro and Pro-expired users (the renew URL is embedded in the tier line itself for the expired case; active-Pro users don't need the line in their face).

Updates skills/axonflow-status/SKILL.md to document the three new shapes and the renew workflow.

Display only — JWT signature validation remains the platform's job.

Self-review (5-question protocol per hunk)

Walked every hunk against (a) commit message accuracy, (b) template / boilerplate residue, (c) env / secret / path correctness, (d) tests exercise the claimed behavior, (e) byte-shippable to a customer.

• scripts/status.sh — added extract_jwt_exp() + format_unix_to_date() helpers (portable base64 -d / -D, date -d @<epoch> / -r <epoch>); refactored the binary TIER flag into TIER_LINE / TIER_KIND / PRO_EXPIRED_FLAG so the formatter can branch cleanly. Token-leak guard preserved (codex#41 redaction shape). The upgrade line is now conditional on TIER_KIND="free" — extra Pro-expired help block prints the renew CTA inline.
• skills/axonflow-status/SKILL.md — added "Tier line shape" section describing the four output shapes (Pro / Pro-could-not-parse / Pro-expired / Free). All references stay cursor-specific (/recover-credentials not /axonflow-recover).
• tests/install-smoke/run.sh — added mint_axon_jwt() helper, then 3 new assertion blocks asserting the regex shape of each tier-line variant. Pre-existing assertions (token leak guard, last-4 redaction, tenant_id surfacing, recovery hint) preserved.
• CHANGELOG.md — single Unreleased entry under "Added", no version bump.

Test plan

CI:

• ci.yml — lint + jest (matrix node 20, 22)
• install-to-use-smoke.yml — exercises tests/install-smoke/run.sh (27 assertions, all 3 tier-line shapes covered)
• definition-of-done.yml (HARD RULE #0 gate)

Local runtime evidence (3 cases, captured against this PR's branch):

=== FREE ===
AxonFlow Cursor plugin — status

  endpoint           https://try.getaxonflow.com
  mode               community-saas
  tenant_id:         (not registered)
  registration file  .../empty/try-registration.json
  license token      unset
  tier               Free (no Pro license configured)
  upgrade            https://getaxonflow.com/pro

  hint: Lost your registration? Run scripts/recover-credentials.sh

=== PRO ACTIVE ===
AxonFlow Cursor plugin — status

  endpoint           https://try.getaxonflow.com
  mode               community-saas
  tenant_id:         (not registered)
  registration file  .../empty/try-registration.json
  license token      set (AXON-...g-pa, source=env)
  tier               Pro (expires 2026-08-03, 90 days remaining)

  hint: Lost your registration? Run scripts/recover-credentials.sh

=== PRO EXPIRED ===
AxonFlow Cursor plugin — status

  endpoint           https://try.getaxonflow.com
  mode               community-saas
  tenant_id:         (not registered)
  registration file  .../empty/try-registration.json
  license token      set (AXON-...g-pa, source=env)
  tier               Free (Pro expired 2026-02-04 — visit https://getaxonflow.com/pro to renew)

  hint: Lost your registration? Run scripts/recover-credentials.sh

  Your Pro license token is on disk but its 'exp' has passed; the plugin will
  not forward an expired token. After buying a renewal, replace the token:

    export AXONFLOW_LICENSE_TOKEN=AXON-...    # current shell
    printf '%s' AXON-... > .../empty/license-token && chmod 0600 .../empty/license-token

tests/install-smoke/run.sh locally: 27 PASS / 0 FAIL.

Notes for the orchestrator

• No version bump. No package.json / plugin.json changes — code merge only per feedback_releases_require_approval.md.
• No release prep. No tag, no GitHub release. Orchestrator handles release approval gating.
• Sister PRs land in parallel for tier-line surface parity across claude / codex / openclaw.