feat(skills): carry devfive-frontend and let a skill be more than one file

[owjs3901]

Why

devup_figma_export returns one screen's TSX, but a project is a tree of routes, and knowing devup-ui does not tell an agent which file that TSX becomes.

The gap is not hypothetical. A vinext project created from service-template was implemented as a Vite SPA — a main.tsx swapping screens on local state, with authored .css files beside code that has globalCss() — by an agent that had been given the devup-ui skill and nothing else.

devup-ui is a styling skill and correctly says nothing about project structure. The rules that would have caught it live in devfive-frontend, which no bare machine had. And devfive-frontend is five files, so carrying it meant a skill could no longer be one document.

What changed

A third origin: own

origin	source of truth	pins a commit	refresh-skills
embedded	another DevFive repo	yes	fetches and moves it forward
own (new)	this repository	no	reseals the manifest from disk
external	someone else's	n/a	reports the install command only

An own skill pins no commit because it has no second copy to drift from — printing at unknown would read as a lost revision rather than one that never existed. Making it an origin rather than a special case keeps both carried origins on the same install path.

Multi-document skills

• manifest.json records documents[{path, bytes, sha256}] per skill instead of one digest per skill, so a five-document skill whose fourth reference was edited fails on that reference, naming it.
• Layout is now skills/<name>/<relpath> for every origin, so a document's source path and its install path are the same string and cannot disagree. The three existing skills were moved with git mv (0 content change).
• install() stages a skill's documents in one OutputTransaction. A SKILL.md that survived while its four references did not is the failure this exists to avoid: it looks installed and its links go nowhere.
• Only the entry document is annotated with provenance, so the manifest digest stays true of every reference that lands on disk.

Two things this surfaced

.gitattributes silently stopped applying. It matched skills/*.md, and a git pattern containing a slash does not let * cross one. Moving the documents into per-skill directories dropped the -text attribute that the file's own comment says exists to stop a Windows checkout from failing the integrity check on that platform alone. Now skills/**/*.md, confirmed with git check-attr.

refresh-skills.mjs had no way to reseal an own skill. It skipped them entirely, so editing a document this repository authors broke the integrity test with no tool offering to fix it — the trap that makes someone write a SHA-256 by hand. For an own skill the direction reverses: the file on disk is the truth and the script reseals the manifest from it. Demonstrated:

~ devfive-frontend/SKILL.md: 13130 -> 18354 bytes   → exit 1
Reconciled 1 document(s) and rewrote the manifest    → exit 0

Skill content

devfive-frontend gained the two rules the SPA incident needed:

• vite.config.ts does not mean Vite. vinext runs Next App Router on Vite, so a normal App Router project has a vite.config.ts and no next.config.ts. Read package.json. There is no main.tsx and no index.html in such a project.
• No .css/.scss in application source. resetCss() + globalCss() + style props, with the @devup-ui/reset-css build recipe (include / optimizeDeps.exclude / ssr.noExternal) that previously had to be reverse-engineered out of node_modules.

It also records the extraction rule from dev-five-git/devup-ui#663, checked against the extractor rather than assumed (extract_style_from_member_expression.rs):

mem.object	result
ArrayExpression / ObjectExpression (inline literal)	static classes
Identifier (external object by name)	dynamic_style() → CSS variable

…and the exception that resolves an internal contradiction in the skill: an external object of css() results is fine, because css() already extracted at its own call site and className is never a style-extraction source (it appears nowhere in extract_style_from_jsx.rs; prop_modify_utils.rs only merges it).

Tests

The integration tests spelled out how many skills exist, so adding one failed four tests that had nothing to say about it. They derive the counts from the report now. Added coverage for the multi-document case: every reference SKILL.md links to must be a file the install writes.

Verification

gate	result
cargo clippy -p devup-mcp --all-targets --all-features -- -D warnings	exit 0, 0 warnings
cargo test -p devup-mcp --all-features	exit 0, 0 failures
node scripts/refresh-skills.mjs --check	exit 0
git check-attr text on all three depths	text: unset

Follow-up (not in this PR)

Fetch-first with embedded fallback for devup_skills install. Two design points to settle first: the provenance note a fetched document carries (it has no commit), and whether the CLI path (--install-skills, which writes to $HOME) unifies with the MCP path (which writes project-locally). Keeping the CLI contract unchanged is the smaller correct change.