feat(ci): check skill packages and content before publishing (2/4)

[miscreantmoogly]

Stacked PR 2 of 4. Based on #126; review and merge in order. This diff shows only this PR's changes.

Description

Adds the rules for what gets published and installed.

Published set. The skill folder minus evals/, .skilleval.yaml, .skilleval.yml, CHANGELOG.md, README.md and images/ (skill-rules/published-files.json).

• README.md and images/ are documentation for GitHub and the Pages site, and the repo's own upload zip command already leaves README out.
• Leaving them out means a docs fix isn't a new version that shows customers an update.

For the published files:

• Limits: at most 100 files, and a zip under 1 MiB less a 64 KiB margin. Warns past 90%.
• Extensions: must be on the skills/.gitignore allowlist.
  • The check parses that file rather than copying the list, so there's one list.
  • It reads the list from the merge base, so a new extension applies once its .gitignore change merges.
  • .gitignore alone can be bypassed with git add -f.
• Paths:
  • only letters, digits, ., _ and -;
  • at most 512 characters;
  • no hidden parts;
  • no Windows-reserved names;
  • no part ending in a period;
  • no two paths that differ only in case.
• No #! files.

Anywhere in the folder, evals/ included:

• regular files only: no executable bits, symbolic links or submodules;
• no scripts/ folders;
• no AWS access key IDs or private keys. The documented example key is allowed.

Content safety:

• Invisible characters in published text are errors. That covers zero-width characters, bidi controls, a BOM and Unicode tag characters, which can hide instructions from reviewers while the model still reads them.
• Raw <script>/<iframe>-style HTML, javascript: links and http:// links in published Markdown are warnings.

All 34 skills pass, and these rules add no new warnings.

Type of change

• Documentation or infrastructure change

Testing

• 102 unit and integration tests pass, including:
  • real executable bits and symlinks committed to throwaway repos;
  • a PR that adds !*.sh to skills/.gitignore and still fails.
• There's a new conformance case for each rule. Key-shaped and invisible-character data is stored as base64, so no file contains a literal key.
• --base-ref origin/main: 34 skills, 0 errors.

[ams-thakkar]

Holding this one, and #125 likewise: @aadimch and @miscreantmoogly have each built the same check independently, and the two are not compatible as they stand — most pointedly, metadata.deprecated is specified oppositely (quoted "true" here, unquoted true in #125), and each documents its own form in CONTRIBUTING.md.

I have asked the two of you to agree on which set to keep.