Add self-update check so installed skills stay current

[phipsae]

What

Installed copies of ethskills (Claude Code plugin, ClawHub) go stale the day after install, while the pointer setups (Codex, Cursor, curl) always fetch live. This PR gives every skill a way to notice it's outdated and refresh itself, and makes the Claude Code plugin itself update per commit.

Four pieces:

1. Per-skill stamp. Every active SKILL.md gets an updated: UTC timestamp in frontmatter (its last real content change from git history) and a short blockquote after the H1. The block tells an agent reading a local copy to fetch https://ethskills.com/versions.json once per session, compare timestamps, and on a newer upstream fetch the live SKILL.md, follow it, and overwrite the local file if writable. In full checkouts, a versions.json entry with no local folder means new skills shipped and the agent tells the user (standalone single-file copies skip this, so they never false-alarm). If any fetch fails, the agent continues with the local copy. ISO UTC timestamps compare as plain strings and keep two same-day edits distinct. The opening clause ("skip if you fetched this live just now") keeps pointer installs from wasting a fetch.

2. versions.json manifest at the repo root, served statically at https://ethskills.com/versions.json (static files win over the /:skill rewrite, so no rewrite change). Served with CORS and Cache-Control: no-cache, must-revalidate so the check never reads a stale manifest (the file is tiny and revalidates via ETag).

3. update-versions.yml workflow. On every real push to master it recomputes each skill's UTC timestamp with git log --first-parent -1 --invert-grep --grep='\[stamp\]' -- <file> (first-parent dates a merged change by the merge commit itself, so merged content always stamps newer than what clients hold), restamps frontmatter, regenerates versions.json, and auto-commits with [stamp] in the message. The --invert-grep keeps stamp-only commits from advancing timestamps, and a monotonic backstop keeps stamps from ever moving backward (committer clock skew). The job sets permissions: contents: write so the auto-commit can push even where the default token is read-only. It can't loop, since GITHUB_TOKEN pushes don't trigger workflows, and an actor guard (github.actor != 'github-actions[bot]') adds a second layer. New skills are picked up automatically by the */SKILL.md glob. The four deprecated redirect stubs (contracts, defi, l2, layer2) are excluded.

4. SHA-based plugin updates. The version fields are removed from plugin.json and the marketplace plugin entry. Per the Claude Code plugin docs, a set version pins the plugin (new commits don't reach users until someone bumps it), while omitting it makes the git commit SHA the version, so /plugin update (and marketplace auto-update where users enabled it) delivers every merged commit with no manual bumps. This also resolves the old 1.0.0/1.1.0 mismatch between the two files. claude plugin validate . passes, the only warning is the intentionally absent version. The install docs (README and homepage table) now tell users to run /plugin update ethskills or enable marketplace auto-update, which is off by default for third-party marketplaces.

Limitations

• Copies installed before this PR have no check block, so they can't self-update. One /plugin update fixes Claude Code installs permanently. Pre-existing ClawHub and curl-baked copies need a manual re-fetch once.
• If this PR is squash-merged and the [stamp] marker is dropped from the squash message, all timestamps collapse to the merge time on the next workflow run. Functionally harmless, and one workflow_dispatch run restamps consistently.

Side finding (out of scope)

update-gas.yml has failed every weekly run since at least 2026-06-22, erroring in the "Check current gas" step with a jq parse error on the eth.llamarpc.com response, which is why the freshness stamp in gas/SKILL.md has been frozen at 2026-03-17. Probably deserves a fallback RPC or error handling in a separate fix.

Verified

• Replayed the workflow's stamp logic locally, generated manifest is byte-identical to the committed versions.json, and all 23 frontmatter stamps match it.
• versions.json parses, workflow YAML parses, claude plugin validate . passes.
• The workflow's push is exercised for real only on the first post-merge run; if it fails despite contents: write, check the repo's Actions default token setting.

🤖 Generated with Claude Code

[vercel]

@phipsae is attempting to deploy a commit to the BuidlGuidl Team on Vercel.

A member of the Team first needs to authorize it.