feat: add AI instruction bundle output

[asimawdah]

Summary

Closes #12.

Adds a generated instruction bundle for SkillMint with detected stacks, evidence, commands, next-step checks, safer output-path handling, manifest integrity metadata, verification checks, low-confidence detection review, and a machine-readable manifest for tooling.

This update extends the same PR with a dedicated AI instruction bundle review policy and a regression guard so generated bundle output has a clear human review path before CI, scripts, or AI agents consume it.

Issue review and prioritization

Open issues reviewed in asimawdah/SkillMint:

1. Feature: Add AI skill detector and generated instruction files #12 — selected/continued because it is clear, high-value, and already represented by this PR, so I extended the existing PR instead of opening a duplicate.

Changes

• Added .ai/instructions bundle generation with README.md, STACKS.md, COMMANDS.md, SAFE_CHANGES.md, NEXT_STEPS.md, and MANIFEST.json.
• Added --instructions-dir for custom output folders.
• Added validation so --instructions-dir stays inside the project root.
• Hardened --instructions-dir by rejecting ambiguous . / .. segments, control characters, project-root targets, and existing-file targets before dry-run planning or file writes.
• Preserved support for absolute --instructions-dir values that resolve inside the project root while keeping manifest paths project-relative.
• Expanded MANIFEST.json with summary metadata, role-path metadata, entrypoints, selected stack IDs, validation command summaries, and SHA-256 hashes for generated Markdown bundle files.
• Added low-confidence detection review metadata for generated bundles: low_confidence_threshold, low_confidence_stack_ids, and requires_detection_review when a selected stack is below the confidence threshold.
• Added NEXT_STEPS.md detection-confidence review guidance so weak detections are manually confirmed before broad automated edits.
• Preserved the caller-selected stack order in generated bundle output and manifest summaries.
• Kept the documented manifest schema contract aligned at 1.6 while adding backward-compatible low-confidence review fields only when needed.
• Strengthened verify_instruction_bundle(...) to check manifest presence, JSON validity, schema/bundle path consistency, expected file lists, entrypoints, files_by_role, integrity metadata, missing files, SHA-256 mismatches, malformed digest values, confidence value shape, and stale low-confidence summary flags.
• Added CLI support for skillmint --verify-instructions with success/failure exit codes for CI and scripted checks.
• Added docs/AI_INSTRUCTION_BUNDLE_REVIEW.md with required detection, validation, integrity, path-safety, and automation-consumption gates.
• Added tests/test_instruction_bundle_review_policy.py to guard the review policy and prevent removal of safety-critical review language.
• Added tests for manifest schema/content, integrity metadata, role metadata verification, file hashes, verification success/failure paths, CLI verification output, summary metadata, output path safety, absolute path portability, README manifest documentation, dry-run output planning, existing-file skip behavior, ambiguous relative segments, control-character rejection, project-root output rejection, existing-file output rejection, malformed digest rejection, stale stack metadata, low-confidence detection review, stale low-confidence summary metadata, invalid confidence values, CLI error output for invalid bundle targets, and review-policy coverage.
• Updated README.md and docs/AI_INSTRUCTION_BUNDLE.md with verification commands, strict digest expectations, detection review guidance, and review workflow guidance.
• Added follow-up CI fixes for newline rendering, selected-stack ordering, absolute-path validation, invalid output target recovery, stale role metadata detection, digest shape validation, documentation/schema drift, backward-compatible low-confidence metadata, and review-policy guard coverage.

Verification

• PR targets main from feature/12-ai-skill-detector-instructions.
• Latest head: bba59ddd54209cf92f47986ad60a2e6d8129033e.
• Branch comparison: 78 commits ahead and 0 behind main.
• GitHub reports this PR is mergeable against main.
• GitHub Actions CI run 28580726553 completed successfully.
• Intended source validation: repository CI/test suite.

Notes

• Extended existing PR feat: add AI instruction bundle output #15 instead of creating a duplicate PR for Feature: Add AI skill detector and generated instruction files #12.
• No merge was performed.