feat: add swamp-extension-publish skill with state-machine checklist

[stack72]

Summary

• Creates a new swamp-extension-publish skill with an 8-state state machine that enforces publishing prerequisites as gates: repo initialization, authentication, manifest validation, collective ownership, version bumping, formatting, dry-run, and push (with explicit user approval)
• Moves publishing.md from swamp-extension-model/references/ to the new skill, adding the missing .swamp.yaml prerequisite documentation
• Updates all four extension creation skills (swamp-extension-model, swamp-extension-vault, swamp-extension-datastore, swamp-extension-driver) and swamp-report to cross-reference the new publish skill instead of duplicating publishing steps
• Registers the new skill in BUNDLED_SKILLS so it ships with swamp repo init and swamp repo upgrade
• Creates trigger evals for the new skill and updates model skill evals to route publishing queries correctly

Fixes #92

Test Plan

• deno check passes
• deno lint passes (1025 files)
• deno run test passes (4310 tests, 0 failures)
• deno run compile succeeds
• npx tessl skill review scores 90%
• Manual end-to-end test of /swamp-extension-publish — state machine runs correctly, prints checklist upfront, walks through all 8 gates, stops at push for user approval

🤖 Generated with Claude Code

[github-actions]

Code Review

Blocking Issues

None.

Suggestions

1. Stale trigger phrases in swamp-extension-model description: The swamp-extension-model/SKILL.md frontmatter description still lists publishing-related trigger phrases ("push extension", "publish extension", "extension push", "release extension", "bump version", "publish to registry", "prepare for publishing") even though the trigger evals were correctly updated to should_trigger: false for those queries. Consider removing them from the model skill's description field to keep the frontmatter consistent with the evals and avoid ambiguity in trigger routing. The Skill Trigger Eval CI passes as-is, so this is a cleanup item only.

Notes

• New skill structure follows all CLAUDE.md conventions: uppercase SKILL.md, required frontmatter with name and description only, body is 273 lines (well under 500 limit), no extraneous files
• The publishing.md rename from swamp-extension-model/references/ to swamp-extension-publish/references/ is properly tracked by git, and all cross-references in the four extension skills + report skill were updated to point at the new location
• skill_assets.ts correctly replaces the old swamp-extension-model/references/publishing.md entry with the new swamp-extension-publish/SKILL.md and swamp-extension-publish/references/publishing.md entries — no stale bundle entries remain
• State 8 (push) properly requires explicit user approval before running the push command — good security practice
• CI passes: lint, test, format, skill review (90%), skill trigger eval
• No DDD concerns — this PR is skill documentation and a minimal infrastructure asset registration change with no domain logic

[github-actions]

Adversarial Review

Critical / High

None found.

Medium

1. Stale orphan file on swamp repo upgrade (src/infrastructure/assets/skill_assets.ts, src/domain/repo/repo_service.ts:287): The copySkillsTo method only adds/overwrites files — it never removes files that are no longer in BUNDLED_SKILLS. When an existing installation runs swamp repo upgrade, the old swamp-extension-model/references/publishing.md will remain as an orphan alongside the new swamp-extension-publish/references/publishing.md. This doesn't break anything (all markdown links are updated to the new path), but the stale file could cause confusion if someone browses the skill directory manually. This is a pre-existing gap in the upgrade mechanism rather than a bug in this PR, but this PR is the first file rename that exposes it.

Low

1. No explicit test for new bundled skill (src/infrastructure/assets/skill_assets_test.ts): Other skills added to BUNDLED_SKILLS have corresponding assertions (e.g., SkillAssets includes swamp-extension-datastore skill at line 428, swamp-extension-driver at line 491). The new swamp-extension-publish skill has no such test. The existing copySkillsTo integration tests will implicitly exercise the new entries (they'd fail if the source files didn't exist), so this is a coverage gap rather than a correctness issue.

2. Dual-trigger ambiguity on manifest creation: The query "Make a manifest.yaml so I can push my extension" is should_trigger: true in both swamp-extension-model and swamp-extension-publish evals. The notes indicate this is intentional (shared concern), but if the skill router can only pick one, the user may get routed to the wrong skill depending on implementation. No action needed if the router supports multi-skill triggers.

Verdict

PASS — Clean refactoring. The only code change is two new entries in the BUNDLED_SKILLS array (skill_assets.ts), which is correct and consistent with the file rename. All cross-references in the five modified skill files are updated to the new path. No logic errors, no security issues, no broken references.