feat(review): generate repo-specific Claude Code / Codex skill files

[JSONbored]

Summary

• Adds src/review/repo-skill-render.ts: shouldGenerateRepoSkill(profile), a trigger predicate built entirely from RepoProfile's existing contributionWorkflow fields (no new signal derivation, keeping feat(review): extract a codebase-grounded repo profile from RAG + signals #2999's extraction primitive generation-agnostic) -- a blocking gate check (gatePublishesCheck), a strict linked-issue rule (requireLinkedIssue && linkedIssuePolicy !== "optional"), and multi-stage CI (ciWorkflowFiles.length >= 2) are each a named, independently-testable sub-check (mirroring src/signals/slop.ts's style); two or more firing is the trigger.
• renderRepoSkillContent(profile) renders a .claude/skills/contributing-to-<repo>/SKILL.md-shaped file -- frontmatter (name/description) plus a procedural body (why it was generated, build/test/lint commands, linked-issue policy) -- following THIS repo's own .claude/skills/contributing-to-gittensory/SKILL.md convention exactly. Returns null when the profile is absent or the trigger doesn't fire, matching renderRepoDocContent's "no partial/placeholder file" discipline.
• Wires delivery into the SAME PR-opening path openRepoDocPullRequest (src/github/repo-doc-pr.ts) already uses for AGENTS.md/CLAUDE.md -- no parallel delivery mechanism. A new "skills" scope value (alongside the existing "agents" value from feat(config): add .gittensory.yml surface to enable/scope repo-doc generation #3002) gates whether the skill file is even considered; when it is, the skill gets its OWN marker pair and its OWN refreshGeneratedDoc call (reused unchanged, per that module's stated design intent from fix(review): make repo-doc refresh diff-aware and preserve manual edits #3004), so:
  • A skill-only content change still opens a PR even when AGENTS.md itself is unchanged (the overall no-change check now considers both).
  • A skill file that looks hand-maintained (no marker block) is excluded from that run rather than blocking the AGENTS.md refresh it rode in with -- unless allowOverwriteExisting (feat(config): add .gittensory.yml surface to enable/scope repo-doc generation #3002) is set, in which case it's discarded in favor of a fresh generate, same as AGENTS.md's own behavior.
• buildRepoDocTree now accepts an optional extraEntries array (the skill file, when included) added to both the symlink-attempt and copy-fallback tree builds; fetchExistingAgentsMdContent is generalized to fetchExistingFileContent(path) and reused for both files.

Part of #2993 (repo-doc generation roadmap). Closes #3001.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint (not run -- no workflow files touched)
• npm run typecheck
• npm run test:coverage -- scoped to the two changed source files: 100% statements/branches/functions/lines on src/review/repo-skill-render.ts and src/github/repo-doc-pr.ts. Full unsharded test:coverage left to CI per this repo's own "don't duplicate CI locally" convention; ran npm run test:changed against origin/main (50 tests across the 2 changed files) plus the broader affected suite directly (406 tests across 8 files, including test/unit/focus-manifest.test.ts and test/unit/no-direct-octokit.test.ts as regression checks) -- all green.
• npm run test:workers (not run -- no Cloudflare-Workers-pool-specific code touched)
• npm run build:mcp / npm run test:mcp-pack (not run -- no MCP package changes)
• npm run ui:openapi:check / npm run ui:lint / npm run ui:typecheck / npm run ui:build (not run -- no apps/gittensory-ui changes, no API/OpenAPI surface changed)
• npm audit --audit-level=moderate (not run locally -- no dependency changes; CI's dependency-review job covers this)
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• Skipped checks above are for UI/MCP/Workers/API surfaces this PR does not touch. CI's validate job runs them as a backstop.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics. (The generated skill file and PR body describe only repo-derived contribution-workflow facts.)
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (Covered: trigger-met/not-met across realistic profile fixtures, scope-excludes-skills, skill-only-change-opens-a-PR, skill-conflict-excludes-without-blocking-agents, and the allowOverwriteExisting override for the skill file specifically.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A -- no API/OpenAPI/MCP surface changed.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A -- no UI changes.)
• Visible UI changes include a UI Evidence section below with screenshots. (N/A -- no visible UI changes.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. (N/A.)

Notes

• The trigger threshold (2-of-3 named signals) is deliberately not a single-signal check: any one signal alone is common in ordinary repos (e.g. two CI workflow files with no real gate is just a standard lint+test split) and would over-propose skill files; requiring two corroborating signals targets repos whose flow is genuinely non-obvious, matching the concrete example the issue itself names (this repo's own gate + strict linked-issue policy + multi-file CI).
• Deliberately did NOT modify src/review/repo-profile.ts (feat(review): extract a codebase-grounded repo profile from RAG + signals #2999) to add a new "auto-close" signal distinct from "has a check" -- the existing fields are sufficient for a reasonable trigger today, and feat(review): extract a codebase-grounded repo profile from RAG + signals #2999's own design explicitly keeps the extraction primitive free of generation-specific concerns.
• Scheduling/on-demand invocation is out of scope here (that's feat(selfhost): scheduled + on-demand refresh for repo-doc generation #3003, next in the roadmap and dependent on this PR) -- openRepoDocPullRequest still has no automatic trigger wired to it, matching how feat(review): generate CLAUDE.md/AGENT.md from the repo profile, delivered as a PR #3000 itself shipped.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.73%. Comparing base (ee4e8ef) to head (e9acf1a).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3174   +/-   ##
=======================================
  Coverage   94.72%   94.73%           
=======================================
  Files         269      270    +1     
  Lines       29619    29666   +47     
  Branches    10806    10824   +18     
=======================================
+ Hits        28056    28103   +47     
  Misses        917      917           
  Partials      646      646           

Files with missing lines	Coverage Δ
src/github/repo-doc-pr.ts	100.00% <100.00%> (ø)
src/review/repo-skill-render.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Important

🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪

🔍 Gittensory is reviewing…

AI analysis is in progress. This comment will update when the review is complete.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟪 Reviewing}