ci: auto-publish skill artifact to tommy0103/obelisk-skill on push to main (Phase 7)

Add a GitHub Actions workflow that builds the readable, non-bundled skill
artifact (`npm run build:skill`) and force-pushes it to the dedicated
tommy0103/obelisk-skill public repo whenever the main branch is updated.
The skill repo is a pure derivative — no manual commits, no PRs; the source
of truth stays in tommy0103/obelisk.

- .github/workflows/publish-skill.yml: checkout → npm ci → build:skill →
  clone skill repo → replace content → commit + force push. Auth via
  SKILL_REPO_DEPLOY_KEY (SSH deploy key with write access to obelisk-skill).
- packaging/skill-README.md: the README placed in the skill repo (install
  instructions + link back to source + "auto-published, don't PR here").
- packaging/skill-LICENSE: MIT license for the skill artifact (relicensed
  from the AGPL-3.0 source by the copyright holder).
- packaging/publish-skill.sh: local convenience script for manual publish.
- packaging/skill-package.json: license field updated to MIT.
- README.md: install command updated to tommy0103/obelisk-skill.
- package.json: add publish:skill script.

The skill repo is MIT-licensed for zero adoption friction (local tool, no
library API, no derivative works expected); the source repo stays AGPL-3.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/publish-skill.yml

@@ -0,0 +1,54 @@
+name: Publish Skill
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - run: npm ci
+
+      - run: npm run build:skill
+
+      - name: Push to obelisk-skill
+        env:
+          DEPLOY_KEY: ${{ secrets.SKILL_REPO_DEPLOY_KEY }}
+        run: |
+          set -euo pipefail
+          mkdir -p ~/.ssh
+          echo "$DEPLOY_KEY" > ~/.ssh/skill_deploy
+          chmod 600 ~/.ssh/skill_deploy
+          export GIT_SSH_COMMAND="ssh -i ~/.ssh/skill_deploy -o StrictHostKeyChecking=no"
+
+          SKILL_DIR=$(mktemp -d)
+          git clone --depth 1 git@github.com:tommy0103/obelisk-skill.git "$SKILL_DIR" || {
+            # First push: init an empty repo
+            git init "$SKILL_DIR"
+            git -C "$SKILL_DIR" remote add origin git@github.com:tommy0103/obelisk-skill.git
+          }
+
+          # Replace all content with the fresh build
+          find "$SKILL_DIR" -mindepth 1 -not -path "$SKILL_DIR/.git*" -delete
+          cp -R dist/obelisk-skill/* "$SKILL_DIR/"
+          cp packaging/skill-README.md "$SKILL_DIR/README.md"
+          cp packaging/skill-LICENSE "$SKILL_DIR/LICENSE"
+
+          cd "$SKILL_DIR"
+          git add -A
+          if git diff --cached --quiet; then
+            echo "No changes to publish"
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git commit -m "publish: $(date -u +%Y-%m-%dT%H:%M:%SZ) from tommy0103/obelisk@${GITHUB_SHA::7}"
+          git push --force origin HEAD:main