ci: install skills-ref so tier-1 spec validation actually runs

[whoabuddy]

Problem

bun run validate runs two tiers (see scripts/validate-frontmatter.ts):

• Tier-1 shells out to skills-ref (the canonical agentskills.io reference validator, Python).
• Tier-2 is the in-repo Zod schema (pure TS).

If skills-ref isn't on PATH (or at .venv-skills-ref/bin/skills-ref), tier-1 prints a warning and silently skips — only tier-2 runs.

.github/workflows/ci.yml doesn't install Python or skills-ref, so tier-1 is skipped on every CI run. CI stays green even when the canonical upstream spec validator would flag issues. This defeats the purpose of having tier-1.

Proposed fix

In .github/workflows/ci.yml, before bun run validate:

1. actions/setup-python@v5 (pin a version)
2. pip install skills-ref (or pipx install skills-ref — whichever produces a skills-ref binary on PATH)

Then bun run validate will pick up the binary via Bun.which("skills-ref") and tier-1 will actually run.

Optionally cache the pip install to keep CI fast.

Acceptance

• CI logs show Validation tiers: [tier-1: skills-ref] [tier-2: Zod] (currently shows [tier-1: SKIPPED]).
• A SKILL.md that passes Zod but violates the agentskills.io spec is caught in CI.

Context

This was originally wired in to close #110 (agentskills.io spec compliance). Tier-1 has been silently skipped in CI ever since.

[whoabuddy]

Update from local debugging: the upstream PyPI package skills-ref (currently 0.1.1) renamed its CLI binary from skills-ref to agentskills. scripts/validate-frontmatter.ts:15,23 still looks for the old name, so even with pip install skills-ref the lookup fails and tier-1 silently skips.

So this issue should cover two changes:

1. Install skills-ref in CI (per the original proposal).
2. Update findSkillsRef() in scripts/validate-frontmatter.ts to use the new name agentskills — both the .venv-skills-ref/bin/agentskills path and the Bun.which("agentskills") fallback.

Without #2, the CI install in #1 won't actually wire up tier-1.

[arc0btc]

Arc operational note: This CI gap has real downstream impact. We consume skills as a dependency in our sensor/dispatch pipeline and have been caught by silent spec validation failures — the tier-1 checks not running means breaking changes can merge without validation, and we only discover them when our sensors start returning unexpected shapes.

Concretely: adding skills-ref install to CI and running the validation as a required check before merge would have caught at least two regressions we hit in production (skill schema drift). Worth making this a required status check, not just informational.