feat(skills): add recommended source catalog

[christso]

Status

Draft implementation complete and independently validated. Kept draft because repository administration must still require pull requests and the Catalog Manifest status check on main.

Summary

• add a typed 11-source recommended skill catalog, separate from marketplace registry state
• add allagents skill search <query> --catalog recommended with a hard repository/subpath boundary and no global fallback
• preserve exact catalog source, root, ref, selectors, and provenance through project-scoped installs and updates
• distinguish selectable marketplaces/subtrees from optional, search-only, and external-lifecycle sources
• fix clean-clone LFS filter handling and add read-only catalog health validation
• document the complete implementation plan in .claude/plans/recommended-skill-catalog.md

Sources

Includes the requested gstack, Paperclip, Matt Pocock, Composio, Hermes core, and Hermes optional sources plus broadly reusable candidates verified from ai-research-wiki: Anthropic Skills, Addy Osmani Agent Skills, Superpowers, Context Engineering Skills, and Anthropic Knowledge Work Plugins.

Elastic Docs Skills was deliberately excluded after review because it is Elastic-product-specific rather than broadly reusable.

Verification

• 130 focused tests passed; 0 failed
• final affected subset: 79 passed; 0 failed
• typecheck and production build passed
• catalog:validate: all 11 sources healthy
• unknown catalog and --catalog + --owner: exit 2
• isolated clean-cache project installs exercised all installable source classes
• Paperclip references preserved; Matt manifest boundary preserved; Hermes core/optional coexist without provenance collapse; sibling assets preserved
• gstack and Composio non-installable selections produced no workspace/cache mutation

[cloudflare-workers-and-pages]

Deploying allagents with    Cloudflare Pages

Latest commit:	40c8f1e
Status:	✅  Deploy successful!
Preview URL:	https://9623558d.allagents.pages.dev
Branch Preview URL:	https://feat-recommended-skill-catal.allagents.pages.dev

View logs

[christso]

Implementation and independent validation are now pushed. The review fixed mixed-policy install grouping, offline user-sync provenance, and catalog pagination starvation. Elastic was removed from the catalog as product-specific. Remaining blocker is repository administration: require PRs and the Catalog Manifest status check on main before merge.

[christso]

Interactive discovery no longer requires users to know --catalog recommended. TTY and full-screen TUI searches now fetch both scopes concurrently and render Recommended first, then deduplicated All GitHub results. Explicit catalog, owner-scoped, JSON, and non-TTY contracts remain unchanged. Focused tests: 85 passed; typecheck/build passed; isolated PTY smoke observed 7 Recommended results above 15 All GitHub results.

[christso]

CI repair and independent full-diff review pushed. Root causes fixed: Biome non-null assertion, Bun suite-wide simple-git mock contamination, and a 5s build hook timeout. Independent review then found and fixed catalog policy-metadata spoofing, all-sections-failed messaging, unsupported simple-git options, subprocess isolation bounds, import-time test builds, unbounded catalog health requests, and stale docs/plan claims.

Post-review CI-equivalent verification on Bun 1.3.12: lint passed; 1,500 tests passed / 5 skipped / 0 failed; typecheck passed; build passed; all 11 catalog sources healthy.

[christso]

Follow-up CI fix pushed: the LFS clone test now derives its expected pointer from the repository's committed blob after Git clean filters run. This removes environment dependence on whether git-lfs is installed while still proving clone skips smudge and does not materialize payload bytes. Bun 1.3.12 full suite: 1,500 passed / 5 skipped / 0 failed; lint and typecheck passed.

[christso]

Second runner-specific LFS fixture issue fixed: CI had git-lfs installed, so the fixture's pre-push hook rejected an intentionally incomplete pointer before cloneTo ran. The test now clones directly from the committed non-bare fixture, avoiding unrelated push hooks while preserving all clone/LFS assertions. Verified with Git LFS 3.7.1 explicitly enabled, full Bun 1.3.12 suite 1,500/0 failures, lint and typecheck.