feat(skills): distribute skills to plugins

[danielkov]

Summary

Skills are distributed by attaching them to plugins — the plugin bundle (already: MCP servers) now carries skills, and delivery rides the existing plugin install/update flow. This replaces the audience-group targeting model from #4266.

• skills.distribute now takes a required plugin_id and upserts one active distribution per (skill, plugin) edge; a skill can be distributed to any number of plugins, each edge tracking latest or pinning a version independently.

• skills.undistribute revokes a single (skill, plugin) edge; skills.listDistributions returns the active edges with plugin id/name and the resolved version.

• Removed the receipts-based getDistributionStatus and listDistributionAudienceGroups endpoints along with all WorkOS directory-group audience logic — plugin assignment is the targeting mechanism, and installation is owned by the harness/marketplace, so per-machine sync status no longer applies.

• Deleting a plugin revokes the distributions it carries (same transaction, one skill:undistribute audit event per edge), mirroring the plugin-server soft-delete cascade. Archiving a skill revokes all of its edges.

• Cross-project references are rejected: distribution requires the plugin to live in the caller's project, and pinned versions must be valid versions of the distributed skill.

• Distributed skills ship inside the generated plugin packages: each platform plugin (Claude Code, Cursor, Codex) gains a skills/<name>/SKILL.md per active distribution, resolved to the pinned version when set or the latest valid version otherwise. Because the publish fingerprints hash generated output, distributing, revoking, or advancing a tracked skill marks the plugin as having unpublished changes — the dashboard publish prompt and the marketplace auto-sync rollout both pick skill changes up exactly like MCP server changes.

Supersedes #4266.

Linear: DNO-428

[linear-code]

DNO-428

[changeset-bot]

🦋 Changeset detected

Latest commit: a5501a9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
server	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 65990c6ebc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cubic-dev-ai]

All reported issues were addressed across 49 files

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 32 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>