feat: reproducible agent skill collection with install/update tooling

- skills-lock.json pins every skill (extracted from infinito-nexus-core)
- make install (global to $HOME) and make project TARGET=<repo> copy the
  rendered skills into .agents/skills + .claude/skills
- make update refreshes the lock via npx skills; make test validates the
  lock shape and shellchecks the scripts
- CI: test workflow on push/PR, daily update workflow opening a PR
- MIRRORS for code.infinito.nexus and git.veen.world

scripts/install.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Render the skills from skills-lock.json and copy them into TARGET.
+# TARGET defaults to $HOME (global install); pass a project root to
+# equip that project. Skills land in <TARGET>/.agents/skills and are
+# mirrored to <TARGET>/.claude/skills.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd -- "${SCRIPT_DIR}/.." && pwd)"
+TARGET="${TARGET:-${HOME}}"
+
+log() { printf '%s\n' "$*"; }
+warn() { printf '%s\n' "$*" >&2; }
+
+if ! command -v npx &>/dev/null; then
+	warn "skills: npx not found — install Node.js first: https://nodejs.org"
+	exit 1
+fi
+
+if [[ ! -d "${TARGET}" ]]; then
+	warn "skills: TARGET does not exist: ${TARGET}"
+	exit 2
+fi
+
+cd "${REPO_ROOT}"
+log "skills: restoring from skills-lock.json..."
+npx --yes skills experimental_install
+
+src="${REPO_ROOT}/.agents/skills"
+if [[ ! -d "${src}" ]]; then
+	warn "skills: ${src} not found after install."
+	exit 1
+fi
+
+for dst in "${TARGET}/.agents/skills" "${TARGET}/.claude/skills"; do
+	log "skills: copying -> ${dst}"
+	rm -rf "${dst}"
+	mkdir -p "${dst}"
+	cp -a "${src}/." "${dst}/"
+done
+
+log "skills: done. Restart your agent to load the skills."

scripts/update.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Update all skills to their latest versions and refresh skills-lock.json.
+# Reads unique sources from skills-lock.json and re-runs skills add for each.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd -- "${SCRIPT_DIR}/.." && pwd)"
+
+log() { printf '%s\n' "$*"; }
+warn() { printf '%s\n' "$*" >&2; }
+
+if ! command -v npx &>/dev/null; then
+	warn "skills: npx not found — install Node.js first: https://nodejs.org"
+	exit 1
+fi
+
+if ! command -v jq &>/dev/null; then
+	warn "skills: jq not found — cannot parse skills-lock.json."
+	exit 1
+fi
+
+cd "${REPO_ROOT}"
+
+lockfile="skills-lock.json"
+if [[ ! -f "${lockfile}" ]]; then
+	warn "skills: ${lockfile} not found in ${REPO_ROOT}."
+	exit 1
+fi
+
+log "skills: updating from ${lockfile}..."
+jq -r '.skills[].source' "${lockfile}" | sort -u | while read -r source; do
+	log "skills: updating ${source}..."
+	npx --yes skills add --yes "${source}"
+done
+log "skills: update complete."