v0.8.0: hard ship gates

v0.8.0: hard ship gates

0.8.0 turns every hand step from shipping resource-optimizer v0.3.0 into a gate the skill and readiness.sh check, so a release cannot miss one.

- uses: maumoya/skill-forger-e2e@v0.8.0
  with:
    ship-gates: true

What changed in 0.8.0

• readiness.sh --ship exits 1 unless every gate is met: OpenSSF Scorecard 7.3 or higher, Best Practices passing, private vulnerability reporting on, a ruleset requiring a PR and CodeQL
• New checks: CodeQL workflow, permissions: read-all, SHA-pinned actions, version in sync across plugin.json, CHANGELOG, README and llms.txt, an action self-test, benefit badges in percentages (no GiB), a README hero card
• scorecard.sh prints the 7.3 ship bar, the exact ruleset and vulnerability-reporting fix commands and a short OpenSSF profile badge
• templates/ruleset-main.json: ready-made "Protect main" ruleset
• marketplace_check.sh fails without a CI self-test or on version drift
• Action input ship-gates; CI now proves the action fails a low-scoring skill
• SKILL.md: missing action.yml flagged up front, owner OK before Update release, launch copy in percentages with a hero card, profile and portfolio updated in the same pass

Measured (2026-11-03)

• Own repo: readiness 100/100, all ship gates met
• Bench, 5 cases x 3 runs: 47% of runs pass with the skill vs 0% without; score 78% vs 38%; time -44%, spend +53% per run

Verify the zip
slsa-verifier verify-artifact skill-forger-e2e-v0.8.0.zip --provenance-path skill-forger-e2e-v0.8.0.intoto.jsonl --source-uri github.com/maumoya/skill-forger-e2e --source-tag v0.8.0

Full Changelog: v0.7.0...v0.8.0