feat: generate plugin skills from a registry of source repositories

[brendanjryan]

Motivation

The docs and wallet skills here are hand-maintained copies that have drifted from their sources, and only Mercator syncs automatically, through a one-off workflow in its own repository. This makes every skill a generated copy declared in one registry, so updates follow their source without manual copying.

Summary

• skills.json registers each distributed skill: docs (tempoxyz/docs main), wallet (tempoxyz/wallet-cli latest release), mercator and mercator-setup (tempoxyz/mercator main)
• skills.lock.json records each copy's source commit and digest; bootstrapped with the Mercator skills, whose files are unchanged
• .github/workflows/sync-skills.yml runs every 30 minutes, on dispatch, and on repository_dispatch: skill-source-updated. It opens one signed PR per plugin with the changed copies, a patch version bump, and regenerated manifests and goldens, then enables squash auto-merge
• validate.yml runs the skill-sync check, so a hand edit to a generated copy fails CI with a pointer to its source
• .github/sts/skill-sync.sts.yaml lets only the main-branch sync workflow open those PRs
• scripts/bump-plugin-version.ts bumps one plugin's patch version so installed clients pick up skill changes
• The docs read-only assertion accepts the canonical "This skill is read-only" wording; README and CONTRIBUTING describe the generated skills

Key design considerations

• Pull-based: source repositories need no workflow. A private source only adds a skill-sync-read STS policy, which Mercator will need before its old push workflow is retired
• Per-plugin PRs isolate failures. The existing content assertions (docs read-only, wallet quote-then-approve) still guard each sync PR, so docs and wallet changes stay blocked until their sources carry that text
• The PR's paths are limited to the plugin's directory, its registry record, the lock, manifest.config.ts, and goldens, so auto-merge only applies to generated changes
• The gh-actions pins point at the open skill-sync and create-pull-request PR commits and will move to their merged SHAs

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T23:31:11.225645Z	da7b738	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: da7b738c0a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".