Package the skill analyzer with standalone artifact handling

[expo-tuft]

Extracts skill-use analysis into @expo/skill-analyzer, a Bun package with compiled ESM, bundled private source-scan code/types, packaged check data, and an installed skill-analyzer executable. Babel and tar remain external runtime dependencies. Requires Bun >=1.3.14.

The package is the only analyzer implementation and entrypoint. Removes old repository import/CLI shims and check-data symlinks; harness tests, reporting imports, authoring, and EAS workflows use the package directly. analyze-artifacts requires explicit --prd-skills; materialize and bundle-check provide the utility commands formerly invoked through repository files. Workflow jobs install workspace dependencies before using compiled packages. The repository's shell orchestration selects its own dataset explicitly.

Scoring, report schemas, and safe artifact extraction remain covered by regression tests and fixed pre-extraction goldens. Published modules share registry/class identity; declarations require neither Bun ambient types nor TypeScript source imports. Releases use bun pm pack to resolve catalog/workspace versions.

Migration guide for the follow-up expo/skills PR covers installation, the two CI analysis call sites, explicit ground truth, report paths, utility commands/imports, and baseline cache invalidation. No expo/skills changes or npm publication are performed here.

Validation: typecheck and 315 TypeScript tests at this layer; 33 targeted Python artifact/workflow tests; npm and Bun isolated analyzer tarball checks (CLI/API, all exports, private registry blocked, materialization, directory/archive inputs, fixed golden parity, and strict NodeNext/Bundler declarations); formatting, shell syntax, and local YAML parsing pass. The downstream release helper's 46 tests also pass after restacking.

EAS server-side validation was attempted for all four changed workflows but the current account cannot read the linked Expo project (Entity not authorized). Local YAML parsing is not a substitute for that validation; it remains to be run by an account with project access. No live workflow/model runs were triggered.

Review / merge order: #40 → #47 → #51 → #55 → #41 → #57 → #59 → #53 → #42 → #50. Stacked on #53.

Clean-install correction: the checked-in bin/skill-analyzer.mjs loads the compiled CLI and exists before Bun links workspace executables. Updated Bun’s cached workspace bin path in the lockfile. Verified a fresh checkout with frozen installation, the installed CLI, and all 315 TypeScript tests.

Test Plan

manual eval run https://expo.dev/accounts/expo-ci/projects/expo-skills/workflows/01a091b6-82d3-7372-ae39-e7967775911a