ci: add manifest-drift gate + correct stale generated artifacts

[Timer]

Summary

Adds a CI gate that fails when the committed generated/skill-manifest.json drifts from its skill sources, and heals the existing drift it surfaced.

The bug this prevents

The committed manifest had silently drifted from source:

• 498c263 (fixing strict workflow skill detection, Apr 30) deliberately removed 11 over-broad workflow path patterns (**/chain-engine*, **/orchestrat*, **/escalation*, **/state-machine*, **/pipeline-engine*, …) from skills/workflow/SKILL.md and the manifest.
• 5641bff (feat(skills): add vercel-connect skill #94, Jun 9, regenerate skill-manifest with vercel-connect) reintroduced them into the manifest only — it regenerated on a branch that predated the Apr 30 removal, so a stale artifact got committed. At that commit skills/workflow/SKILL.md had zero occurrences of those patterns.

Root cause: CI runs bun run build (which regenerates the manifest into the working tree) and then tests against that fresh copy. It never checks the committed manifest against source, so a stale commit sails through. The manifest also embeds a volatile generatedAt timestamp, so a plain git diff --exit-code can't be used.

Fix

• scripts/build-manifest.ts --check — rebuilds in-memory, compares to the committed file (normalizing generatedAt), exits non-zero on drift. Exposed as bun run build:manifest:check.
• CI — runs build:manifest:check and the existing build:from-skills:check before bun run build, so they validate committed artifacts on the pristine tree instead of after the build clobbers them.
• Corrections — regenerated skill-manifest.json (workflow patterns) and skill-catalog.md (workflow patterns + a stale vercel-connect entry that had also drifted).

Verification

• bun run build:manifest:check → passes on the healed manifest; fails (exit 1) when a stale pattern is reintroduced (tested).
• bun run validate → passes (only the pre-existing workflow chainTo warning).
• bun test → 878 pass, 0 fail.

🤖 Generated with Claude Code

---

Note

Low Risk
Changes are CI ordering plus regenerated docs/catalog metadata; they tighten correctness of skill routing patterns without touching runtime app code.

Overview
CI now fails when committed generated artifacts drift from skill sources, by running bun run build:manifest:check and moving build:from-skills:check before bun run build so checks run on the pristine checkout instead of after the build overwrites regenerated files.

generated/skill-catalog.md is refreshed to match current sources: workflow drops the reintroduced broad path globs (back to 6 path patterns), and vercel-connect reflects current path/import detection (agent/connections/**, agent/channels/**, @vercel/connect/eve).

^{Reviewed by Cursor Bugbot for commit 5a55c8f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Timer]

Follow-up commit 5a55c8f: the first CI run surfaced a real cross-platform bug — scanSkillsDir() iterated readdirSync() directly, whose order is filesystem-dependent (alphabetical-ish on macOS/APFS, arbitrary on Linux/ext4). So the macOS-generated committed manifest didn't match a fresh Linux build and build:manifest:check failed on the runner. Fixed by sorting the scan, which makes manifest/catalog generation byte-identical on every platform (one-time reordering churn, no semantic change). CI is now green. ✅

This is a nice validation that the gate works — it caught non-determinism that was previously invisible.