Harden cloud-agent validation and CI diff checks

[naytewilson]

What changed

• Make scripts/validate.sh safe when the checkout path contains spaces.
• Add scripts/test-validate.sh regression coverage for valid skills, name/directory mismatch, README omissions, and path safety.
• Make the GitHub Actions whitespace gate inspect the actual pushed commit range instead of an empty origin/main...HEAD range on pushes to main.
• Keep AGENTS.md, Copilot instructions, README, operator docs, and the pull-request checklist aligned with the new minimum gate.

Why this is the smallest complete change

The existing cloud-agent setup is useful and structurally sound. This PR changes only the validator, its direct regression coverage, the affected CI range logic, and documentation that names the required checks. It does not alter any interactive skill or fstack-run behavior.

Evidence

Current validator reproduction under a checkout path containing spaces:
sed: can't read /mnt/data/fstack: No such file or directory
exit=2

Current main-push whitespace command reproduction:
git diff --check origin/main...HEAD
exit=0

Correct pushed-range reproduction:
file.txt:2: trailing whitespace.
+bad trailing space 
exit=2

Local proposed checks:
sh -n scripts/validate.sh
sh -n scripts/test-validate.sh
sh scripts/test-validate.sh
=> Validator tests passed.

Validator against a 14-skill fixture under `/mnt/data/fstack 14 fixture`:
=> Validated 14 skills.

Workflow YAML parse with Ruby Psych:
=> YAML syntax: PASS

GitHub Actions run 30628576773 on Ubuntu 24.04:
- Check shell syntax: success
- Test validator: success; `Validator tests passed.`
- Validate skill collection: success; `Validated 14 skills.`
- Check changed text for whitespace errors: success

Skill and documentation checks

• sh -n scripts/validate.sh
• sh -n scripts/test-validate.sh
• sh scripts/test-validate.sh
• sh scripts/validate.sh against the complete repository in GitHub Actions
• git diff --check against the PR base in GitHub Actions
• Documentation and agent instructions updated
• No skill behavior changed
• No secrets, credentials, private local paths, or generated files added

Missing evidence or remaining risk

• gh skill publish --dry-run was not run because GitHub CLI is not available in the execution container.
• Repository-level branch protection, required-check rules, and security settings require host configuration and are not changed by this PR.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 67529e4ff3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Check the whole branch on its first push

When a new feat/** or fix/** branch is pushed, GitHub sets before to the all-zero SHA and leaves GITHUB_BASE_REF empty, so this fallback runs. The git show [<options>] <object>... command receives only HEAD, meaning whitespace errors in earlier commits from the same initial push are skipped; for example, a two-commit branch whose first commit adds trailing whitespace passes when its tip is clean. Compare the new branch with its base branch instead so the repository's required git diff --check gate covers the complete change.

AGENTS.md reference: AGENTS.md:L41-L49

Useful? React with 👍 / 👎.