Port automatic agent-skills sync workflow

[jumski]

Goal

Port an automatic sync workflow so opencode-supabase stays up to date with supabase/agent-skills skill content.

Current State

opencode-supabase vendors real skill files under skills/ and updates via script-assisted manual sync:

bun run skills:sync <commit-sha>

This fetches a repo tarball at the given commit, replaces managed skill dirs, and records provenance in skills/.upstream.json.

Upstream Reality

supabase/agent-skills has no GitHub releases and no tags. The release-based sync workflow in supabase-community/supabase-plugin has never worked (failing every Monday since creation). The plugin also updates skills manually (e.g., PR #14). Release-based automation is aspirational dead code in both repos.

Desired Automation (future)

Two viable automation paths once upstream stabilizes:

A) Poll for new commits (works today)

• Trigger weekly and via workflow_dispatch
• Resolve latest supabase/agent-skills commit on main
• Compare commit SHA against skills/.upstream.json
• Run bun run skills:sync <sha> equivalent
• Open PR with peter-evans/create-pull-request

B) Poll for releases (requires upstream change)

• Same as above, but polling releases instead of commits
• Depends on supabase/agent-skills publishing GitHub releases

Acceptance Criteria

• No runtime clone/install
• No hidden build-time fetch
• Sync PR contains real file diffs
• Provenance tracked in .upstream.json

[jumski]

Status update from issue audit:

This is still relevant, but upstream facts in the original body are now stale. supabase/agent-skills now has GitHub releases and tags (v0.1.1 through v0.1.5 observed), so release polling is no longer blocked on upstream adding releases.

Recommended adjustment:

• Keep this issue open.
• Prefer the release/tag polling path now, unless default-branch commit polling is intentionally preferred.
• Remove/update the old claim that upstream has no releases or tags.
• Acceptance criteria remain valid: no runtime clone/install, no hidden build-time fetch, sync PR contains real diffs, provenance recorded in skills/.upstream.json.