Vendor skills as flat skills/ children for marketplace install

[heyglassy]

Summary

Today codex plugin marketplace add planetscale/codex-plugin installs zero skills. Both Codex install paths git clone without --recurse-submodules (and the bundle-tar path rejects links, so symlinks don't help either), so skills/ and database-skills/ arrive empty. It only works for us because we clone recursively. So: submodules out, skills vendored in — generated by scripts/sync-skills.py, with upstream commits recorded in .codex-plugin/skill-sources.json. The weekly workflow re-runs the sync and opens a PR.

All 21 skills are direct children of skills/, two of them index skills that route to the rest:

skills/database/SKILL.md      -> database-mysql | database-postgres | database-vitess | database-neki
skills/planetscale/SKILL.md   -> safe-orchestrator | readonly-inventory | ... (15)

Flat on purpose: .codex-plugin/plugin.json discovers skills recursively, but Agent Plugins v1 manifests walk skills/ at max_depth: 2 and OpenAI's validator only inspects direct children — a nested tree would load only the two indexes under the newer format. Index prose lives in skill-index/<ns>/SKILL.md; the sync regenerates the routing table between <!-- BEGIN GENERATED INDEX --> markers from each child's description, so it can't drift.

Non-obvious bits of the sync:

• Renames to keep names readable and collision-free. Codex addresses skills as plugin:skill, so the upstream planetscale- prefix is stripped (planetscale:safe-orchestrator), while engine skills take a database- prefix so mysql/postgres aren't global names.
• Rewrites cross-skill links. Upstream links siblings as ../01-readonly-inventory/SKILL.md; the rename broke all 32. Remapped via an upstream-dir → vendored-name table, then validate_references() fails the sync on any dangling link (31 refs, 0 dangling).

Also fixes what the validator was rejecting: "skills" pointed at ./database-skills/skills/ (outside the accepted root, so the database skills shipped where Codex can't import them), shortDescription was over the 30-char limit, skills/script/ had no SKILL.md, and the required logo/logoDark/composerIcon assets were missing. validate_plugin.py now passes; sync is idempotent.

Draft until the two blockers outside this repo clear: mcp.pscale.dev/.well-known/openai-apps-challenge 404s (domain verification), and the tool readOnlyHint/openWorldHint/destructiveHint annotations are unverifiable behind OAuth.

Link to Devin session: https://app.devin.ai/sessions/03b6759590044baea63ffb497eecad20
Open in Devin Desktop: https://app.devin.ai/desktop/session/03b6759590044baea63ffb497eecad20?variant=devin
Requested by: @heyglassy

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring