chore(skills): add release-widget skill

[yordan-st]

Summary

• Adds `.agents/skills/release-widget/SKILL.md` — automates widget/module release pipeline (version bump → GitHub draft release → OSS clearance → Marketplace publish)
• Previously ran as private trial (untracked); opening as draft for team feedback before promoting to shared skill set

Test plan

• Used successfully for image-web v1.6.0 and charts-web v6.3.2 releases

[r0b1n]

This should be a cli helper that return this, we already have all the code that parses those nicely.

[r0b1n]

All those helpers (applies to all places where agent is asked to write js code) should not be written here in the skill, those have to be helpers that agent can use as cli tools.

[github-actions]

AI Code Review

⚠️ Approved with suggestions — low-severity items only, safe to merge

---

What was reviewed

File	Change
.agents/skills/release-widget/SKILL.md	New 8-phase release skill with autonomy carve-out
automation/utils/bin/rui-bump-version.ts	New CLI helper — bumps package.json + package.xml
automation/utils/bin/rui-create-jira-version.ts	New CLI helper — creates Jira version (non-blocking)
automation/utils/bin/rui-generate-oss-sbom.ts	New CLI helper — downloads MPK, generates SBOM zip
automation/utils/bin/rui-package-info.ts	New CLI helper — prints package metadata as JSON
automation/utils/bin/rui-upload-readme-oss.ts	New CLI helper — uploads READMEOSS HTML to draft release
automation/utils/package.json	Registers 5 new bin entries

Skipped (out of scope): dist/, pnpm-lock.yaml

CI checks could not be retrieved in this environment — verify passing before merge.

---

Findings

⚠️ Low — xmlBumped reports true when bumpXml returns false

File: automation/utils/bin/rui-bump-version.ts line 22–28
Problem: bumpXml returns Promise<boolean> — false when package.xml exists but has empty content, true when actually bumped. The bin ignores the return value and only sets xmlBumped = false on a thrown exception. If the file exists but is empty, the output JSON reports xmlBumped: true while the XML was not actually modified. An agent relying on this output would be misled.
Fix:

let xmlBumped = false;
try {
    xmlBumped = await bumpXml(path, version);
} catch {
    xmlBumped = false; // modules have no package.xml
}

---

⚠️ Low — SBOM output path hardcoded to ~/Downloads with no env-var override

File: automation/utils/bin/rui-generate-oss-sbom.ts line 35
Problem: ~/Downloads is hardcoded as the SBOM zip output location with no env-var escape hatch, unlike the JAR path which supports SBOM_GENERATOR_JAR. In headless or Linux CI environments (no ~/Downloads directory), the file is written to a path that may not exist. The SKILL.md also references this hardcoded location without warning.
Fix: mirror the JAR pattern — check SBOM_OUTPUT_DIR first:

const outputDir = process.env.SBOM_OUTPUT_DIR ?? join(homedir(), "Downloads");
const finalPath = join(outputDir, `${releaseName} [pending-hash].zip`);

Document the env var in SKILL.md's Phase 4 description.

---

Positives

• The "Common Mistakes" section is exceptionally useful — it captures real incident history (409 double-trigger, speculative reruns, silent appNumber misdetection) as concrete anti-patterns. This is exactly the kind of knowledge that prevents repeat incidents.
• Phase 6's asset gate (require both .mpk and *READMEOSS* before publish) is the right hard stop — the SKILL.md explicitly names this as the root cause of a prior 409 double-trigger.
• Phase 8 (rollback) correctly excludes itself from the autonomy carve-out — listing teardown commands and waiting for explicit confirmation before running any is the correct safety pattern for irreversible operations.
• All five bin scripts are lean entry points that correctly delegate to existing automation/utils/src/ modules rather than reimplementing logic; all imported symbols (bumpPackageJson, bumpXml, getNewVersion, getPackageInfo, Jira, gh, createSBomGeneratorFolderStructure, generateSBomArtifactsInFolder, findAllReadmeOssLocally, getRecommendedReadmeOss) were verified to exist with the expected signatures.
• Non-blocking Jira version creation (always exits 0, status via stdout JSON) is the right resilience pattern for a transient external dependency that must never gate a release.