feat(bg_remover): harden skill to v0.2.0 - #268

Thanks for the clean branch, much better than #266, I will close 266 and track here.

This is closer on the runtime core (session cache, basic validation, 25 MB limit, mkdir for output_path, tests), but it is not yet enough to close #257. Please treat the issue acceptance criteria as a checklist and finish them in this PR.

Still missing / fix

1. Rebase on current main (post-0.4.7 / citation) so CHANGELOG/Unreleased merges cleanly.
2. Path safety: reject traversal / unsafe output_path (and document the rule).
3. Apply size + decode checks to Base64 too (not only input_path).
4. PIL verify(): reopen the image after verify() before reuse (classic gotcha).
5. Manifest / errors: document FILE_NOT_FOUND (and any new codes) in manifest.yaml error_code + keep instructions.md / catalog aligned.
6. [Skill Upgrade]: creative/bg_remover — hardening to 0.2.0 #257 deliverables still open:
   • examples/bg_remover_demo.py + examples/README.md row
   • wire docs/usage/agent_loops.md (not catalog-only)
   • optional first-run / model-download hint in response or docs (as scoped in the issue)
7. Prefer loading version/metadata from manifest.yaml instead of a second hardcoded dict in skill.py if other skills already do that pattern.

Bump is fine as 0.2.0 once the above is in. Ping when the PR matches the full #257 checklist, I will re-review <3

Thanks @AyushSrivastava1818, re-reviewed the latest commits on. The runtime core is in good shape now and mostly matches the earlier review / #257: session reuse, Base64 validation + shared 25 MB check, PIL verify() reopen, output_path traversal reject + parent mkdir, demo + agent_loops wiring, and expanded bundle tests. Local skill tests were also green here.

That said, this is very close but still a bit behind ideal state and not completely ready to close #257 yet. Please ammend these in this PR so we don’t need a follow-up:

Musts

1. CHANGELOG, move the bg_remover entry under [Unreleased] (do not edit the already-shipped [0.4.7] section).
2. examples/README.md, restore normal spacing. The file currently has extra blank lines throughout; please revert that rewrite and only add the bg_remover_demo.py row cleanly.
3. Error-code docs, add FILE_NOT_FOUND to the error tables in both instructions.md and docs/skills/bg_remover.md (code/manifest already have it; docs still list only INVALID_INPUT / MISSING_DEPENDENCY / PROCESSING_FAILED).

Polish hints (same PR if easy)

• Prefer loading the skill manifest property from manifest.yaml instead of a second hardcoded dict (loader already uses the YAML, this just avoids version drift).
• One oversized Base64 (>25 MB) golden test.

Ping when those three must-fix items land and I’ll re-review for merge and close #257. <3 Good job so far and for following the steering accurately.

Hey @AyushSrivastava1818, re-reviewed the latest fixes and most things are cleaned correctly. Well done <3

One tiny blocker before merge / close #257

In docs/usage/agent_loops.md, the creative/bg_remover row is missing the final Ollama column. Other rows have 7 cells, this one stops after DeepSeek. Please restore, as I think you had it before:

| creative/bg_remover|bg_remover_demo.py (local execute) | (catalog page) | (catalog page) | (catalog page) | (catalog page) | (catalog page) |

Optional but nice to have in this PR to avoid follow up PR:

• Prefer loading skill.manifest from manifest.yaml instead of the hardcoded mini-dict, check other skills how manifest is used
• Add a trailing newline to instructions.md or ci might fail on main

After these are in, I’m happy to merge and close #257. Good work iterating on this. <3

@AyushSrivastava1818, thanks for iterating on this, the runtime hardening looks good and matches the scope nicely.

To save you another round-trip, I pushed a small maintainer commit onto your branch:

• removed the accidental commit-message line after the bg_remover_demo.py row in examples/README.md
• switched skill.py to load manifest metadata from manifest.yaml instead of a hardcoded mini-dict (avoids version drift)

Bundle + registry docs tests still pass on my side. Good to merge from here, I'll merge and close #257 once CI is green.

Nice work on this one. <3

@rosspeili can we connect on slack too?

@AyushSrivastava1818 I don't use Slack outside orgs I am in, but you we can connect on any social or via email if you have any questions outside Skillware / ARPA repos.

@rosspeili Okayy Bhai...will stay in touch loved contributing to skillware..great experience here...