fix: refresh bundled skill safety and workflows

src/crates/assembly/core/builtin-skills-upstreams.json

@@ -0,0 +1,43 @@
+{
+  "schema_version": 1,
+  "synced_on": "2026-07-22",
+  "sources": [
+    {
+      "skills": ["docx", "pptx", "xlsx"],
+      "repository": "https://github.com/anthropics/skills",
+      "revision": "fa0fa64bdc967915dc8399e803be67759e1e62b8",
+      "local_patches": [
+        "normalize upstream trailing whitespace",
+        "route documented archive editing through safe_extract and rezip",
+        "bound archive extraction and reject normalized-path collisions",
+        "use BitFun as the default Word comment author",
+        "retain the BitFun 2026 year-format example"
+      ]
+    },
+    {
+      "skills": ["agent-browser"],
+      "repository": "https://github.com/vercel-labs/agent-browser",
+      "revision": "81c336c1c20b80ac648e0416a7b6e0c0ae7878bb",
+      "package_version": "0.32.3",
+      "local_patches": [
+        "route web and supported Electron work to agent-browser and native desktop work to BitFun ComputerUse",
+        "pin the documented install version and require user approval",
+        "preserve explicit missing-prerequisite and no-silent-fallback behavior"
+      ]
+    },
+    {
+      "skills": ["gstack-*"],
+      "repository": "https://github.com/garrytan/gstack",
+      "revision": "7e96fe299b085010fb2e34d9c4fbfc7e44b617e1",
+      "revision_basis": "latest upstream commit before the BitFun import timestamp",
+      "bitfun_import_commit": "6341358703da217c3b2dd8e887ca877c35acaafc",
+      "local_patches": [
+        "preserve existing BitFun Team Mode orchestration, Task, AGENTS.md, and .bitfun/team conventions",
+        "repair bundled skill references and remove references to absent workflows",
+        "replace pseudo browser commands with version-checked agent-browser commands",
+        "preserve BitFun ComputerUse for native desktop UI",
+        "avoid credential leakage and cross-target auth-profile reuse"
+      ]
+    }
+  ]
+}