feat: auto-refresh vendored agent skills via PR-driven flow

[xergioalex]

Summary

Turns every upstream release of DailybotHQ/deepworkplan-skill or DailybotHQ/agent-skill into a new release of this website, unattended — the same PR-driven pattern this repo already uses for npm dependency upgrades (check_packages_versions.yml + check_and_merge_packages_upgrades_pr.yml).

Two new workflows work in tandem:

check_vendored_skills.yml — daily 12:00 UTC + workflow_dispatch

1. Resolves the latest tag of each upstream skill via gh release view --repo <owner/repo>.
2. Compares against the currently vendored version in .agents/skills/<name>/SKILL.md. Computes per-skill dwp_moved / db_moved flags — installs only the skills that actually moved, so a partial refresh produces a truthful commit subject (chore: refresh vendored skills to deepworkplan v2.16.3, not the misleading deepworkplan v2.16.3, dailybot v3.10.3 when only one advanced).
3. Force-resets the feature__vendored_skills_refresh branch from main, runs npx --yes skills add <repo>@<tag> --skill <name> --force -y, asserts the installed SKILL.md frontmatter version: equals the resolved tag (invariant), commits, and force-with-lease pushes.
4. Opens (or gh pr edits an existing) PR titled 🤖 Refresh vendored skills to (…) with a diff-style from/to table and release-notes links.
5. workflow_dispatch accepts optional inputs deepworkplan_tag and dailybot_tag for pinning / rollback.

check_and_merge_vendored_skills_pr.yml — daily 17:00 UTC + workflow_dispatch

1. Finds the open PR from feature__vendored_skills_refresh.
2. Reads mergeable_state via gh api repos/.../pulls/<n>.
3. If "clean" (required checks green, no conflicts, branch up to date) → gh pr merge <n> --merge. Any other state → leaves the PR for a human. Never force-merges.

The chain

Merging the auto-generated PR fires release_and_publish.yml normally (pull_request: closed && merged == true), which bumps package.json, tags vX.Y.Z, publishes a GitHub Release, and Cloudflare Pages deploys. Latency from upstream skill tag to a live website release with the refreshed skill vendored inside: ~24h, hands-off.

Design decisions worth flagging

• PR-driven, not release-driven. An earlier iteration triggered on release: published and pushed a follow-up dogfood commit. That was the wrong direction — a new skill should be the reason for a release, not an appendix to one. This design cuts a real version bump for each upstream skill release.
• Only installs skills that actually moved — no wasted work, no misleading commit subjects.
• All logging on stderr inside the resolve() shell function. Command substitution captures stdout, so annotations must go to stderr or they end up inside the captured tag string and break the equality check.
• --force-with-lease push on the bot-owned refresh branch — safe because the branch is 100% owned by the automation and force-reset from main at the start of every run that needs it.

Test plan

Once merged (this PR itself will produce a normal v1.0.75 release via the existing flow):

• Confirm the workflow files show up under Actions in the GitHub UI (both Check Vendored Skills and Check & Merge Vendored Skills PR).
• Run check_vendored_skills.yml via workflow_dispatch with no inputs. Expected outcome given today's state (.agents/skills/deepworkplan/SKILL.md = 2.16.1, upstream latest = 2.16.3): a PR opens titled 🤖 Refresh vendored skills to deepworkplan v2.16.3 (assuming dailybot is already at 3.10.3 upstream = current).
• Confirm the PR body includes the diff table and the release-notes link.
• Optionally trigger check_and_merge_vendored_skills_pr.yml manually to auto-merge the PR (needs CI green on the refresh PR first).
• Merge → release_and_publish.yml fires → v1.0.75 or similar release published.
• Verify no unrelated workflows retriggered on the refresh push.

Files changed

• + .github/workflows/check_vendored_skills.yml (new)
• + .github/workflows/check_and_merge_vendored_skills_pr.yml (new)
• M .github/docs/WORKFLOWS.md (sections 6 & 7 + dependency graph)
• M AGENTS.md / CLAUDE.md (via symlink) — new "Vendored agent skills" subsection describing the auto-refresh flow

Notes for reviewers

• Prerequisites the automation depends on (already satisfied):
  • AUTOMATION_GITHUB_TOKEN has contents: write + pull-requests: write scope and can bypass branch protection on main (same PAT used by release_and_publish.yml and check_packages_versions.yml).
  • Branch protection on main allows the same PAT to merge PRs via gh pr merge (already the case for the packages flow).
• The auto-generated refresh PR gets a size label + PR-body length check from pull_request_check.yml automatically. Any PR the bot opens has enough body text to clear the 10-char minimum.

[xergioalex]

Cerrando en favor de un patr\u00f3n m\u00e1s simple: refrescar las skills como parte del release existente (release_and_publish.yml), no como un ciclo aut\u00f3nomo separado. El objetivo real es que las skills se actualicen s\u00f3lo cuando el maintainer decida cortar una release del website \u2014 no correr en background sin control. Un nuevo PR viene con esa versi\u00f3n.