chore: add github-actions-spec skill for verifying GHA changes

[wadackel]

Summary

Adds a Claude Code project skill, github-actions-spec, that grounds GitHub Actions / JavaScript Action work in the live official GitHub Docs (fetched on demand, not embedded) so proposed changes are verified against authoritative material rather than the model's memory.

The skill contains only a URL catalog and a fetch workflow — no spec content is duplicated locally, so the skill does not drift as GitHub Docs and the toolkit evolve.

Scope of triggering

The skill activates on changes touching:

• action.yaml / action.yml (inputs, outputs, branding, runs.using, pre/post)
• .github/workflows/* (triggers, permissions, concurrency, reusable workflows)
• The JS action runtime (Node version, dist/ bundling, main entrypoint)
• @actions/toolkit usage (core, github, exec, io, etc.)
• GITHUB_TOKEN permissions, secrets, OIDC, pull_request_target boundary
• Event triggers, contexts, and expressions

Verification workflow

For each in-scope change the skill follows: identify scope → pick canonical URL(s) from the catalog → WebFetch with a specific question → cross-check the proposed change against the doc → surface adjacent risks (deprecations, breaking changes, downstream regeneration like pnpm generate:inputs / pnpm build / dist/ commit).

Built and validated via /skill-improver

The skill went through 3 empirical iterations against 3 frozen scenarios (add a boolean input, bump runs.using, add a fork-PR feedback workflow) plus 1 hold-out (request an unsupported node26 runtime). All four runs produced 100% accuracy with explicit doc citations and correct refusal-with-alternative behavior. Patches applied during iteration:

1. Description shortened to 843 chars to satisfy the agentskills.io 1024-char spec limit.
2. Output expectations reshaped to handle both "verify existing change" and "design new artifact" deliverables.
3. URL catalog refreshed after a GitHub Docs reorg: 1 hard 404 fixed (secure-use#permissions-for-the-github_token) and 14 redirected URLs updated to their post-redirect canonical paths. Fetch-fallback guidance added for future doc moves.

References

• n/a