fix: repair release archive publishing so the marketplace ships all skills

[heyglassy]

Summary

Cursor shows only the 4 database-skills skills because the marketplace serves the newest GitHub Release asset, and that's still the tarball from v1.0.1 — built before the skills submodule existed.

v1.1.0 was never really released: the release PR was hand-authored (#10) instead of merging release-please's, so release-please never tagged it, and the archive steps (gated on release_created) never ran. The version bump in plugin.json alone does nothing for users.

Three changes:

1. Releases can be published manually. release.yml now has a publish-archive job that also runs on workflow_dispatch with a tag input, creating the release if needed. Dispatching it with v1.1.0 fixes the current situation, and any future missed upload too. The tag must look like vMAJOR.MINOR.PATCH (which also keeps a --prefixed input from reaching gh as a flag), and an already-existing tag is checked out and archived from its own tree, so re-dispatching an old version can't overwrite its asset with newer code.
2. Weekly submodule bumps are releasable. The bot committed as chore:, which release-please ignores — so skill updates would never reach a tarball. Now fix:.
3. A release can't ship without skills. Both workflows call the new script/validate-skills.sh, which fails if either skills directory is empty and logs what it found. It also replaces a hardcoded list of 14 skill names that would have broken the weekly bot on any upstream rename.

Plus a ## Releases note in CONTRIBUTING.md recording the rule that was broken here: only ever merge release-please's own PR.

Validation

actionlint and shellcheck pass. Running the workflow's tar command locally produces an archive with all 18 SKILL.md files (4 + 14) and no unresolved symlinks.

Link to Devin session: https://app.devin.ai/sessions/3f256659316c425facc3ef65f3eb5c50
Open in Devin Desktop: https://app.devin.ai/desktop/session/3f256659316c425facc3ef65f3eb5c50?variant=devin
Requested by: @heyglassy

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 2 potential issues.

[heyglassy]

Rebased onto current main, tightened tag validation, added the logo to release archives, signed all commits, and verified the workflows and archive build.

AI-assisted: Please review before merging.