feat: publish generated plugin distributions

[ethanoroshiba]

Description

Make the repository canonical source rather than an installable plugin root. Build portable Agent Plugins v1, Claude-native, and Codex marketplace distributions from one skill library, then publish versioned archives, unpacked packages, checksums, and release metadata through GitHub Pages.

The publish workflow follows cdp-api's Pages pattern (configure-pages, upload-pages-artifact, and deploy-pages), adapted for public GitHub runners. It uses pinned Actions, minimal permissions, vendored versioned schemas, an exact Coinbase MCP endpoint allowlist, and strict SemVer validation before constructing output paths.

Change type

• Harness integration or metadata
• Skill workflow
• Bug fix
• Documentation
• Breaking change: consumers install a generated distribution instead of the repository root

Validation

• Distribution builder completes successfully

• Portable manifest and MCP config pass the vendored Agent Plugins v1 schemas

• Generated archive checksums verify

• Claude package passes strict native validation

• Distribution builder passes Ruff lint and formatting checks

• Workflow YAML parses successfully

• SemVer path guard rejects traversal input

• Codex native CLI validation not run; CLI unavailable locally

• Generated portable manifest and MCP config validate against the vendored Agent Plugins schemas

• Package paths and skill references remain inside each generated plugin root

• Marketplace, skills, MCP, and icon paths are valid

• Exactly one canonical skill library; generated copies are not committed

• Claude compatibility metadata/endpoint and marketplace sources agree with the portable package

• Tool schemas, authorization, and retry behavior reviewed — unchanged

• README and changelog updated; versions consistent

• No unapproved disclosures or sensitive data

• Signed commits

Release considerations

• Configure this repository's Pages source for GitHub Actions before the first deployment if it is not already enabled.
• Native authenticated harness and OAuth smoke tests remain pending.
• Marketplace submission remains separately gated by release approval.

Made with Cursor

[cb-heimdall]

✅ Heimdall Review Status

Requirement	Status	More Info
Reviews	✅ 1/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1