fix: installer portability, description limits, and eval honesty

[arpitg1304]

Follows #6 and #9 — this is the remaining work from the same review pass. The frontmatter
name/directory fix and the install.sh traversal fix landed there; this covers what was left.

Skill loading

Two descriptions exceeded the 1024-character frontmatter limit, risking truncation or
rejection by the loader:

Skill	Before	After
robot-bringup	1181	1015
docker-ros2-development	1078	1003

Trimmed by cutting duplicated trigger keywords — multi-stage builds, udev rules, and
X11 forwarding each appeared twice in their own description. No coverage lost.

Installer portability

install.sh was broken on macOS in two places:

• list_skills used find -printf, which BSD find does not support.
• The --skills all path used mapfile, absent from the bash 3.2 that macOS ships.

Both replaced with portable equivalents, verified under real /bin/bash 3.2: --list,
--skills all (10/10 skills), the default bundle, explicit selection, and the exit codes
for missing-target (2) and unknown-skill (1).

Eval honesty

Neither generated package in evals/ actually builds:

• without-skills — CMakeLists.txt never installs the Python package or the node, so
  nothing is runnable.
• with-skills — install(PROGRAMS ...) lacks RENAME, so the executable is
  demo_recorder_node.py while the launch file requests demo_recorder_node.
• both — a setup.py that is dead under <build_type>ament_cmake</build_type>.

These are documented rather than patched. They're verbatim agent output, and editing
them would destroy their value as evidence. Added a defects table, a banner on each package
README, methodology caveats (n=1, self-assessed, line counts measure volume rather than
quality), and corrected two conclusion sentences that claimed more than had been verified.

SROS2 examples

permissions.xml used not_after 2026-01-01 — already expired, so copy-pasting it produced
immediately-invalid permissions. Moved to 2035 and documented expiry as a silent-outage
failure mode: under Enforce, participants are rejected at discovery with no topic error
and no crash.

Prevention

• scripts/validate_skills.py — name/directory match, description length, frontmatter
  validity, README and install.sh consistency. No dependencies beyond Python 3, so
  contributors can run it directly. It reproduces every frontmatter defect found in this
  review, including the one fix: match skill frontmatter name to parent directory #6 fixed.
• .github/workflows/validate.yml — runs the validator, shellcheck, and an install.sh
  smoke test on Linux and macOS. The rejection case asserts traversing and injecting
  names are refused before any filesystem operation, so fix: validate skill names before use in install.sh #9's fix cannot silently regress.

The validator also warns above a 1000-line-per-skill budget. Four skills exceed it today;
that's left as documented debt rather than an error, so it never blocks a contribution.

Verification

validator:   0 errors, 4 warnings (the line-budget debt)
install.sh:  syntax OK under bash 3.2; all happy paths pass
rejections:  does-not-exist, ../evals, ../../skills, /etc, "skills;rm" all refused
             no traversal side effects on disk

Note for release notes

Anyone who installed before #6 has stale ros1-development/ros2-development directories.
install.sh removes the new name before copying, so a re-install leaves both and the
stale pair still won't load. Worth telling people to delete those two directories.

🤖 Generated with Claude Code