Cache stability: static memory tools, guardrail tail placement, Anthropic cache audit, tokenizer adapter, skill load warnings

[MyPrototypeWhat]

First follow-up PR from the section-④ discussion (scope agreed item-by-item in session). Theme: keep the prompt prefix byte-stable across compiles — prompted by the observation that tool-list changes and system-prompt injections were invalidating provider prompt caches.

Changes (@context-chef/core minor → 4.1.0)

1. Static memory tool definitions — modify_memory previously embedded an enum of live memory keys and only appeared once keys existed: every key mutation rewrote the tool schema, and since tools are the topmost prefix segment, that invalidated the entire prompt cache. Now both tools are always emitted with static schemas (same object references every compile); current keys are still surfaced via the injected memory block, and unknown-key dispatches keep failing safely at updateMemory/deleteMemory.
2. withGuardrails({ placement: 'last_user' }) — on Anthropic, all system-role messages hoist into the top-level system prefix, so the default guardrail delivery busts downstream cache breakpoints on every options change. The new placement routes the enforce-XML text through the last-user-message tail injection (the <EPHEMERAL_MESSAGE> wording was originally designed for user-stream delivery). prefill unchanged.
3. auditAnthropicCachePlacement(payload) + ChefConfig.cacheAudit — deterministic, Anthropic-only audit (the one provider with explicit breakpoints; zero heuristics): flags volatile content (memory data / dynamic state / implicit context / guardrail instructions) at or before the last cache_control breakpoint, with a per-issue suggested fix. cacheAudit: true warns each distinct issue once per instance.
4. createTokenizerAdapter(encode) — zero-dependency glue turning any (text) => tokens encoder into a correct JanitorConfig.tokenizer, encoding the fields-counted convention once (content + thinking + redacted data + tool-call names/arguments). Footprint: 648 bytes in dist, zero new dependencies (core still depends only on zod).
5. Skill loader warnings — SkillLoadResult.warnings: mechanical checks on dir loads (thin description, oversized instructions, malformed allowedTools, dangling relative links); never blocks a load. (Replaces the earlier standalone skill-lint idea per discussion — creation-time quality is covered by skill-creator tools; the npm skill-lint package is a security scanner, different niche.)

Verification

pnpm lint ✓ · build ✓ · all typechecks + typecheck:compat + examples ✓ · 1112 tests (core 866 [+34], ai-sdk-middleware 132, tanstack-ai 114) ✓ · README updated (en + zh, five sections each).

Not in this PR (next up per discussion): B — handoff (mechanical + LLM tiers) + branch/fold (outcome-oriented fold prompt as the core deliverable); C — FileMemory (zero-injection, memory_20250818-compatible commands over VFS); backlog — prepareStep durable in-loop compaction + per-step activeTools narrowing.