feat(skills): vendor dmmulroy/anti-slop install-anti-slop skill

[danievanzyl]

Closes #96

Adds dmmulroy/anti-slop as a vendored provider (scripts/skill-sources.json) and syncs its only skill, install-anti-slop (an Oxlint plugin installer: SKILL.md, scripts/install.mjs, assets/anti-slop/), into skills/. MIT license, matches the existing mattpocock provider. scripts/sync-skills.sh is unchanged — the skills[] directory-copy path already handled this.

Diff is additions only: new skills/install-anti-slop/ + vendor/dmmulroy/, plus the 7-line provider entry. (A sync run also picked up unrelated upstream drift in mattpocock/ogulcancelik content — reverted, out of scope for this issue.)

shepard-tests: DISCOVERED=1 RAN=1 PASS=14 FAIL=0 sha=1396d665555e3cf4d10b75749660c93c5ee32310

[danievanzyl]

🤖 AFK runner completed work at 1396d665555e3cf4d10b75749660c93c5ee32310.

[danievanzyl]

🤖 AFK runner completed work at 1396d665555e3cf4d10b75749660c93c5ee32310.

[danievanzyl]

Regression survey — verdict: CLEAN

Later-observer pass over the full git diff main...HEAD (Runner + Reviewer, three-dot from merge-base). Scope: behaviour that worked before this diff and does not work now. No quality, naming, or standards commentary — that is the Reviewer's pass, already done.

Tree assertions before surveying: git status --porcelain empty, HEAD = 1396d66 = PR headRefOid.

Diff shape: 28 additions, 1 modification (scripts/skill-sources.json, pure insertion). Zero deletions, zero renames.

Surfaces enumerated and probed

#	Surface	Result
S1	scripts/sync-skills.sh behaviour for the other two providers	No change to the file. Per-provider loop is independent; jq 'null | length' = 0 keeps the absent include_categories branch a no-op, same as the existing ogulcancelik entry already proves
S2	Existing vendored skills under skills/ pruned or altered	None. No D or existing-path M in the diff. Prune loop iterates skills/*/ (top level only) and matches on exact .provider equality, so the nested assets/ tree is out of its reach
S3	vendor/ attribution for existing providers	vendor/mattpocock/ and vendor/ogulcancelik/ untouched
S4	scripts/skill-sources.json validity	Parses. All three providers resolve: mattpocock cats=2 skills=0, ogulcancelik cats=0 skills=1, dmmulroy cats=0 skills=1
S5	Skill auto-discovery	No duplicate frontmatter name: across skills/*/SKILL.md. Every top-level dir under skills/ still has a SKILL.md
S6	Plugin packaging / manifest	Neither plugin.json nor .claude-plugin/marketplace.json enumerates skills/, so nothing to fall out of sync. New provider is MIT, matching the plugin license — ADR-0003 untouched
S7	CI workflows	tests.yml path filter includes scripts/**, so this PR triggers it. sync-skills.yml calls the unchanged script
S8	eval/src/version.ts skills SHA stamp	git log -n1 -- agents/ skills/ still resolves; the stamp value moves, the behaviour does not
S9	Hooks / settings.json path guards	No hook references skills/, LICENSE, or the .vendored-from marker

No regression found. No test committed — a failing test is only for a real finding, and there is none.

Test result consumed from this run at the PR head, not re-derived:

shepard-tests: DISCOVERED=1 RAN=1 PASS=14 FAIL=0 sha=1396d665555e3cf4d10b75749660c93c5ee32310

shepard-survey: SURFACES=9 PROBED=9 FINDINGS=0 sha=1396d665555e3cf4d10b75749660c93c5ee32310

[danievanzyl]

🤖 AFK runner completed work at 1396d665555e3cf4d10b75749660c93c5ee32310.