Vendor skills as flat skills/ children for marketplace install

[heyglassy]

Summary

The problem: Installing via codex plugin marketplace add planetscale/codex-plugin silently installs zero skills. Codex clones without --recurse-submodules (and the bundle path rejects symlinks), so skills/ and database-skills/ arrive empty. It only ever worked for us because we clone recursively.

The fix: Drop the submodules and vendor the skills directly. scripts/sync-skills.py pulls them from upstream and records source commits in .codex-plugin/skill-sources.json; a weekly workflow re-runs the sync and opens a PR when upstream changes.

Layout

All 21 skills live flat under skills/, with two index skills routing to the rest:

skills/database/SKILL.md      -> database-mysql | database-postgres | database-vitess | database-neki
skills/planetscale/SKILL.md   -> safe-orchestrator | readonly-inventory | ... (15)

Flat is deliberate — Agent Plugins v1 and OpenAI's validator only look at direct children of skills/, so nesting would break discovery under the newer format. The index routing tables are regenerated by the sync from each child's description, so they can't drift.

How the sync keeps things sane

• Renames for readability and collision-safety: the planetscale- prefix is stripped (Codex already namespaces as planetscale:skill), and engine skills get a database- prefix so mysql/postgres aren't global names.
• Rewrites all links: the renames broke all 32 cross-skill links, and 48 upstream raw.githubusercontent.com links now point at the vendored copies so a bundled plugin reads its own files, not upstream main. Validation then fails the sync on any dangling link (81 refs checked, 0 dangling).
• Transactional: everything is built and validated in a staging dir and only swapped in when it all passes — a failed sync leaves the committed tree untouched.

Also fixed

Everything the plugin validator was rejecting: the skills path pointed outside the accepted root (so the database skills shipped where Codex can't import them), shortDescription exceeded the 30-char limit, skills/script/ had no SKILL.md, and the required logo/icon assets were missing. validate_plugin.py now passes and the sync is idempotent.

Remaining blockers (external to this repo)

• Domain verification: mcp.pscale.dev/.well-known/openai-apps-challenge still 404s (checked 2026-08-31).
• The MCP tool readOnlyHint/openWorldHint/destructiveHint annotations can't be verified behind OAuth.

---

Link to Devin session: https://app.devin.ai/sessions/03b6759590044baea63ffb497eecad20
Requested by: @heyglassy

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 3 potential issues.

[SimeonGriggs]

Stamped, but I see Devin's got some comments

[devin-ai-integration]

@SimeonGriggs all three review comments are already fixed in d444768: upstream raw.githubusercontent.com links now resolve to the vendored files next to them, the sync builds/validates in a staging dir and swaps in only on success, and the weekly workflow derives the expected skill set from .codex-plugin/skill-sources.json instead of hard-coded counts.

Still draft only because of the two blockers outside this repo: domain verification (mcp.pscale.dev/.well-known/openai-apps-challenge 404s) and the OAuth-gated tool hint annotations.

[heyglassy]

Re-requesting review after re-signing the full commit series to satisfy the default-branch signature rule. All 11 commits are GitHub-verified. This update also moves skill-sources.json out of the reserved .codex-plugin/ directory and re-runs the deterministic sync, 81-reference validation, workflow layout validation, JSON checks, and release archive test successfully.