chore: make the one-command skills install actually install only the ten public skills

[ValentinJSchmidt]

Summary

Beat's feedback asked us to use vercel-labs/skills
as the install path for local agents. That route already existed (INSTALL.md Route C,
Step 0) but was dirty: the installer offered 12 skills instead of ten. This marks the
two repo-internal maintainer skills as internal, so the one-command route installs exactly
the ten skills that belong together.

INSTALL.md is deliberately untouched — shortening it is a separate call.

Motivation

The skills CLI discovers skills in skills/ and in agent directories, including
.claude/skills/ and .codex/skills/. Those hold create-thesis-sim-student and
run-thesis-simulations, which exist only to run our own simulation suite against this
repo. They showed up in the interactive picker between the real skills, and
--skill '*' — which INSTALL.md tells students to pass — installed them into a student's
client, where they are useless at best.

What Changed

	Before	After
npx skills add … --list	Found 12 skills	Found 10 skills
--skill '*' install	12 skill folders	10 skill folders
Picker contents	10 public + 2 maintainer	10 public

• metadata.internal: true on both maintainer skills, in each agent directory (4 files).
  The CLI honours this for the picker and for the '*' wildcard (src/skills.ts:115,
  src/add.ts:1143). The key is part of the Agent Skills frontmatter spec, so Claude Code
  and Codex still load both skills repo-locally — confirmed in a live session.
• skills/tests/test_skills_cli_install.py — asserts the discovered, non-internal skill
  set across skills/, .claude/skills/ and .codex/skills/ is exactly the ten public
  skills, and that every copy of a maintainer skill carries the flag.
• qa.yml path filter extended to .claude/skills/** and .codex/skills/**, so the new
  check runs on exactly the changes it guards.
• STATUS.md log entry.

Known Issues / Not Yet Done

• Beat's actual complaint — INSTALL.md is too long — is not addressed here. This only
  makes the one-command route he pointed at reliable. With this merged, local agents
  genuinely need one line, which makes a later trim easier.
• No .claude-plugin/marketplace.json, so /plugin marketplace add is still not a route.
  Left out as scope creep; easy follow-up if we want it.

How to Run / Test

python -m pytest -q                      # 52 passed, 10 skipped
npx skills@latest add . --list           # Found 10 skills
npx skills@latest add . --skill '*' --agent claude-code --copy -y   # in a scratch dir

Verified end-to-end on this branch: the real install produces ten skill folders with their
references/ intact, and the new test fails if the internal flag is removed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01H8uhg9be5GbE6QpPHipwta

[Copilot]

🟢 Approval recommended

The changes are low-risk, align with the stated goal, and include a targeted regression test plus CI path coverage to prevent the installer surface from regressing.

Pull request overview

This PR cleans up the npx skills add one-command install path so that only the 10 public skills are discoverable/installable, by marking the two maintainer-only simulation skills as internal and adding regression tests to prevent them from leaking into the installer surface.

Changes:

• Marked create-thesis-sim-student and run-thesis-simulations as metadata.internal: true in both .claude/skills/ and .codex/skills/.
• Added a pytest regression test to assert that only the 10 public skills are offered by the CLI discovery surface and that maintainer skills remain internal.
• Expanded the QA workflow path filter so CI runs when .claude/skills/** or .codex/skills/** changes.

File summaries

File	Description
STATUS.md	Logs the install-surface cleanup and verification notes.
skills/tests/test_skills_cli_install.py	Adds deterministic tests asserting the non-internal discovered skill set equals the public skills set.
.github/workflows/qa.yml	Ensures QA runs when agent-local skill directories change.
.codex/skills/run-thesis-simulations/SKILL.md	Marks maintainer skill internal for Codex.
.codex/skills/create-thesis-sim-student/SKILL.md	Marks maintainer skill internal for Codex.
.claude/skills/run-thesis-simulations/SKILL.md	Marks maintainer skill internal for Claude.
.claude/skills/create-thesis-sim-student/SKILL.md	Marks maintainer skill internal for Claude.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ValentinJSchmidt]

Good catch — adopted in 6a50ab2. PUBLIC_SKILLS is gone; the test now derives the expected set from the skills/ directories that contain a SKILL.md, so it only asserts "nothing outside skills/ reaches the installer surface". test_skill_package.py::test_expected_portable_skills_exist stays the single place that pins the canonical ten.