feat(skills): manage bundled skill updates

.github/workflows/pr.yml

@@ -15,6 +15,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
 
       - name: Install native build tools
         run: sudo apt-get update && sudo apt-get install -y build-essential python3 zlib1g-dev zsh
@@ -69,6 +71,11 @@ jobs:
       - name: Check reliability gate manifest
         run: pnpm run check:reliability-gates
 
+      # Why: skill revisions are append-only; checking merge-queue and main
+      # heads prevents independently green PRs from claiming one revision.
+      - name: Verify bundled skill manifest
+        run: pnpm run verify:skill-bundle-manifest -- --base-ref=origin/${{ github.base_ref }}
+
       # Why: oxlint fails any file over max-lines that is NOT suppressed, so this
       # ratchet forbids ADDING a new suppression (inline disable or mobile max
       # bump). Existing oversized files are grandfathered in

.github/workflows/release-cut.yml

@@ -472,7 +472,10 @@ jobs:
           # message and tag name explicitly (avoids npm's `v1.2.3` prefix
           # assumptions and any lifecycle scripts that would run on bump).
           npm version "$VERSION" --no-git-tag-version --allow-same-version
-          git add package.json
+          # Why: the versioned release commit is the mechanical authority that
+          # records exactly which generated skill revisions shipped.
+          node config/scripts/generate-skill-bundle-manifest.mjs --write --record-release
+          git add package.json resources/skills
           commit_message="release: v$VERSION"
           if [[ "$EVENT_NAME" == "schedule" ]]; then
             commit_message="$commit_message [rc-slot:$SLOT]"
@@ -1220,7 +1223,6 @@ jobs:
             Write-Warning 'Restored pre-rebuild installer; this release ships with unsigned inner binaries.'
           }
       # ── End Windows inner-binary signing ───────────────────────────────
-
       - name: Upload unsigned Windows installer for SignPath
         if: matrix.platform == 'win'
         id: upload-unsigned-windows-installer

.github/workflows/skill-cli-roundtrip.yml

@@ -0,0 +1,38 @@
+name: Skill CLI round trip
+
+on:
+  pull_request:
+    paths:
+      - 'skills/**'
+      - 'resources/skills/**'
+      - 'config/scripts/generate-skill-bundle-manifest.mjs'
+      - 'config/scripts/verify-skill-cli-roundtrip.mjs'
+      - '.github/workflows/skill-cli-roundtrip.yml'
+  merge_group:
+  push:
+    branches:
+      - main
+
+jobs:
+  roundtrip:
+    continue-on-error: ${{ matrix.skills-cli == 'latest' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, ubuntu-latest, windows-latest]
+        skills-cli: ['1.5.16', latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: package.json
+      - name: Verify LF and CRLF installer identities
+        shell: bash
+        run: |
+          node config/scripts/verify-skill-cli-roundtrip.mjs --cli=${{ matrix.skills-cli }} --autocrlf=false --shape=symlink
+          node config/scripts/verify-skill-cli-roundtrip.mjs --cli=${{ matrix.skills-cli }} --autocrlf=false --shape=copy
+          node config/scripts/verify-skill-cli-roundtrip.mjs --cli=${{ matrix.skills-cli }} --autocrlf=true --shape=symlink
+          node config/scripts/verify-skill-cli-roundtrip.mjs --cli=${{ matrix.skills-cli }} --autocrlf=true --shape=copy

.github/workflows/skill-manifest-merge-gate.yml

@@ -0,0 +1,21 @@
+name: Skill manifest merge gate
+
+on:
+  merge_group:
+  push:
+    branches:
+      - main
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: package.json
+      # Why: rerunning generation on the integrated head prevents two skill
+      # changes from independently claiming the same immutable revision.
+      - run: node config/scripts/generate-skill-bundle-manifest.mjs --base-ref=HEAD^