Conform package to registry conventions and rework credential flow

.github/workflows/build.yml

@@ -0,0 +1,20 @@
+name: Build
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths-ignore: ['*.md']
+    branches: ['main']
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    if: github.event.pull_request.draft == false
+    uses: start9labs/shared-workflows/.github/workflows/build.yml@master
+    # with:
+    #   FREE_DISK_SPACE: true
+    secrets:
+      DEV_KEY: ${{ secrets.DEV_KEY }}

.github/workflows/release.yml

@@ -0,0 +1,33 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*.*'
+
+jobs:
+  guard:
+    runs-on: ubuntu-latest
+    outputs:
+      id: ${{ steps.read.outputs.id }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: read
+        run: |
+          id="$(awk -F"'" '/id:/ {print $2; exit}' startos/manifest/index.ts)"
+          echo "id=$id" >> "$GITHUB_OUTPUT"
+
+  release:
+    needs: guard
+    if: needs.guard.outputs.id != 'hello-world'
+    uses: start9labs/shared-workflows/.github/workflows/release.yml@master
+    with:
+      # FREE_DISK_SPACE: true
+      RELEASE_REGISTRY: ${{ vars.RELEASE_REGISTRY }}
+      S3_S9PKS_BASE_URL: ${{ vars.S3_S9PKS_BASE_URL }}
+    secrets:
+      DEV_KEY: ${{ secrets.DEV_KEY }}
+      S3_ACCESS_KEY: ${{ secrets.S3_ACCESS_KEY }}
+      S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
+    permissions:
+      contents: write

.github/workflows/tagAndRelease.yml

@@ -0,0 +1,38 @@
+name: Tag and Release
+
+on:
+  push:
+    branches: ['main']
+    paths-ignore: ['*.md']
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  guard:
+    runs-on: ubuntu-latest
+    outputs:
+      id: ${{ steps.read.outputs.id }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: read
+        run: |
+          id="$(awk -F"'" '/id:/ {print $2; exit}' startos/manifest/index.ts)"
+          echo "id=$id" >> "$GITHUB_OUTPUT"
+
+  tag:
+    needs: guard
+    if: needs.guard.outputs.id != 'hello-world'
+    uses: start9labs/shared-workflows/.github/workflows/tagAndRelease.yml@master
+    with:
+      REFERENCE_REGISTRY: ${{ vars.REFERENCE_REGISTRY }}
+      # FREE_DISK_SPACE: true
+      RELEASE_REGISTRY: ${{ vars.RELEASE_REGISTRY }}
+      S3_S9PKS_BASE_URL: ${{ vars.S3_S9PKS_BASE_URL }}
+    secrets:
+      DEV_KEY: ${{ secrets.DEV_KEY }}
+      S3_ACCESS_KEY: ${{ secrets.S3_ACCESS_KEY }}
+      S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
+    permissions:
+      contents: write

.gitignore

@@ -5,5 +5,4 @@ node_modules/
 .vscode/
 docker-images
 javascript
-ncc-cacheai-service-packaging/
-CLAUDE.md
+ncc-cache

AGENTS.md

@@ -0,0 +1,9 @@
+# AGENTS.md
+
+This is a StartOS service-package repository — it builds a `.s9pk` for StartOS.
+
+Develop it inside a StartOS packaging workspace created by `start-cli s9pk init-workspace`,
+which provides the packaging guide and agent context one level up. If you're reading this in a
+bare clone with no workspace, the full guide is at <https://docs.start9.com/packaging>.
+
+Work this package's `TODO.md` from top to bottom. Keep `README.md` (architecture, for developers and LLMs) and `instructions.md` (end-user docs) in sync with your changes.

CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md