chore(skills): add release-widget skill

[yordan-st]

Summary

• Adds `.agents/skills/release-widget/SKILL.md` — automates widget/module release pipeline (version bump → GitHub draft release → OSS clearance → Marketplace publish)
• Previously ran as private trial (untracked); opening as draft for team feedback before promoting to shared skill set

Test plan

• Used successfully for image-web v1.6.0 and charts-web v6.3.2 releases

[github-actions]

AI Code Review

⚠️ Approved with suggestions — low-severity items only, safe to merge

---

What was reviewed

File	Change
.agents/skills/release-widget/SKILL.md	New skill: automates the full widget/module release pipeline from version bump through Marketplace publish

Skipped (out of scope): CI checks not available in this run.

---

Findings

⚠️ Low — Phase 0 snippet interpolates $(pwd) inside a single-quoted heredoc

File: .agents/skills/release-widget/SKILL.md line 33–37
Note: The snippet uses '...' quoting around the ts-node -e argument, but $(pwd) won't expand inside single quotes in bash. The skill's own "Common Mistakes" section already warns to use absolute paths — but the example code pattern is subtly broken for copy-paste use. A reader following the snippet literally will get a literal $(pwd) string passed to Node. Consider either showing the expansion outside the string or using $(realpath .) as part of a variable assignment before the heredoc, or annotating the snippet with "replace $(pwd) with the actual absolute repo root."

---

⚠️ Low — sed changelog read command will include the boundary ## [ line

File: .agents/skills/release-widget/SKILL.md line 71
Note: The pattern sed -n '/## \[Unreleased\]/,/## \[/p' prints the stop-pattern line itself (the previous release header), which pollutes the version-selection summary. Using /## \[Unreleased\]/,/## \[/{/## \[Unreleased\]/!{/## \[/!p}} or a simpler awk equivalent (e.g. awk '/## \[/{if(found)exit} /## \[Unreleased\]/{found=1} found') would cleanly exclude the boundary line. Low impact in practice since a human is reviewing the summary, but it could cause the agent to miscount "Breaking changes" entries if a previous version header happens to contain the word.

---

⚠️ Low — "What to flag" list absent from skill

File: .agents/skills/release-widget/SKILL.md (whole file)
Note: Per skill review conventions, new skill sections should include a concrete "What to flag" list of anti-patterns the agent should catch. The ## Common Mistakes section is a good equivalent, but it reads as developer-facing post-mortems rather than agent-facing decision triggers. A short "Abort conditions" or "What to flag to the user" subsection mirroring the code-review skill's style would make it clearer what situations should surface to the human vs be handled autonomously.

---

Positives

• Autonomy carve-out is tightly scoped: the explicit list of pre-authorized actions (git push, gh workflow run, gh pr merge, gh release edit --draft=false) with a clear negative boundary (rollback excluded) is exactly the right pattern for a release skill — it avoids both over-asking and over-autonomy.
• Asset gate in Phase 6 directly prevents the documented 409 incident: the "refuse to publish if MPK or READMEOSS is missing" rule directly encodes the root cause of the prior double-trigger failure, which is the right way to bake institutional memory into a skill.
• State re-derivation design: documenting that the skill has no persisted state and can be safely stopped/resumed across days is excellent — makes the OSS clearance wait window explicit and reproducible.
• All automation helper APIs are correctly cited: getPackageInfo, getNewVersion, bumpPackageJson, bumpXml, gh.getReleaseIdByReleaseTag, gh.listReleaseAssets, gh.uploadReleaseAsset, createSBomGeneratorFolderStructure, and generateSBomArtifactsInFolder all resolve to the actual exports in automation/utils/src/ — no invented function names.
• 409 disambiguation logic in Phase 7 is specific and actionable: the ordered checklist (prior success? → double-trigger? → real conflict?) prevents the "3 speculative reruns" antipattern documented in the incident history.

[r0b1n]

This should be a cli helper that return this, we already have all the code that parses those nicely.

[r0b1n]

All those helpers (applies to all places where agent is asked to write js code) should not be written here in the skill, those have to be helpers that agent can use as cli tools.