feat: add proactive Skill optimization workflow

[zwliJay]

Summary

SkillHone can now capture reproducible Skill defects during normal Agent work and turn them into reviewable local repairs. Any CLI-capable Agent can record an Issue; the configured queue dispatches a focused DeepSeek Harness repair and preserves the Issue, Run, test, commit, diff, PR, and Wiki history for review.

What changed

• Replaced the service-dependent workflow with a TypeScript CLI and lightweight local Web workbench.
• Isolated Issues, pull requests, runs, Wiki records, tests, and Git history per Skill repository.
• Added skillhone init and import/sync modes for Codex, Claude Code, Cursor, and other Skill-capable Agents.
• Added queued, immediate, and scheduled repair policies, with serial dispatch and one local PR per Issue.
• Added explicit review or test-gated automatic local merge policies; nothing is pushed automatically.
• Integrated the pinned, on-demand @deepseek-ai/dsh@0.1.5-rc.2 repair runtime while keeping model and credential configuration owned by Harness.
• Preserved the evaluation-driven workflow with a separate frozen Eval repository.
• Added a reproducible public Phoenix tracing example based on upstream Issue #2567 and fix #2568.
• Added GitHub source installation, verified release-package automation, bilingual workbench UI, security checks, and third-party notices.

Reproduction

The public example recreates the Phoenix tracing Skill before its broken reference links were fixed:

python3 examples/phoenix-tracing/prepare_fixture.py /tmp/phoenix-tracing
cd /tmp/phoenix-tracing
python3 .test/test_reference_links.py

The baseline fails because four local reference targets are missing. During normal Agent use, the bundled routing Skill records that defect, dispatches the queued repair, reruns the linked regression test, and creates a local PR for review.

Validation and results

• Command: npm test
• Result: 30/30 passed
• Clean-install E2E: empty SkillHone home → pinned Harness install → native model probe → Phoenix failure → Issue → queued dispatch → repair → local PR → Wiki
• Linked Phoenix regression: 1/1 passed after repair
• Review-mode checkout: returns to main; the unmerged repair remains isolated on its PR branch
• gitleaks dir . --redact --no-banner: no leaks found
• gitleaks git --redact --no-banner --log-opts=<main>..HEAD: no leaks found
• pnpm audit --prod: no known vulnerabilities
• npm pack --dry-run: 51 files, approximately 128 KB, no examples, datasets, run artifacts, or runtime npm dependencies
• Phoenix provenance: pinned commit, Skill tree, upstream license object, and Apache-2.0 text verified during fixture creation
• git diff --check: passed

Effect and limits

Agents no longer need a separate hosting service to record and review Skill maintenance. Repairs remain local and auditable: SkillHone does not push a Skill repository, and review-mode PRs are not merged without an explicit user decision. DeepSeek Harness is installed only when repair execution is requested; other Agents interact through the runtime-neutral CLI and bundled Skills.

Review checklist

• The public Issue and reproduction are clear.
• Focused repository tests pass, with counts reported above.
• The branch is a single squashed commit over main.
• I ran git diff --check.
• I ran gitleaks on both the current tree and branch commit.
• This change contains no API keys, private prompts, private traces, generated local state, or experiment-selection records.
• No generated repair was pushed or merged automatically.
• Final merge remains a maintainer decision.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.