Port automatic agent-skills sync workflow #46

Goal

Port an automatic sync workflow so opencode-supabase stays up to date with supabase/agent-skills skill content.

Current State

opencode-supabase vendors real skill files under skills/ and updates via script-assisted manual sync:

bun run skills:sync <commit-sha>

This fetches a repo tarball at the given commit, replaces managed skill dirs, and records provenance in skills/.upstream.json.

Upstream Reality

supabase/agent-skills has no GitHub releases and no tags. The release-based sync workflow in supabase-community/supabase-plugin has never worked (failing every Monday since creation). The plugin also updates skills manually (e.g., PR #14). Release-based automation is aspirational dead code in both repos.

Desired Automation (future)

Two viable automation paths once upstream stabilizes:

A) Poll for new commits (works today)

• Trigger weekly and via workflow_dispatch
• Resolve latest supabase/agent-skills commit on main
• Compare commit SHA against skills/.upstream.json
• Run bun run skills:sync <sha> equivalent
• Open PR with peter-evans/create-pull-request

B) Poll for releases (requires upstream change)

• Same as above, but polling releases instead of commits
• Depends on supabase/agent-skills publishing GitHub releases

Acceptance Criteria

• No runtime clone/install
• No hidden build-time fetch
• Sync PR contains real file diffs
• Provenance tracked in .upstream.json