feat: installable Skill bundle endpoint - item 3 of 2245

[jung-thomas]

Implements item 3 of #2245 (Executable, self-verifying, self-healing tutorials): turns a published tutorial into an installable agent Skill.

What

GET /content/tutorials/:slug/skill returns a zip bundle:

• SKILL.md — the tutorial procedure with a provenance/freshness stamp (confidence, last-verified, source-commit, optional signed JWS).
• verify.sh — a runnable bash verifier generated from the tutorial's assert blocks (cmd/http/file), every interpolated value shell-quoted against injection.

Design

• Feature flag: SKILL_BUNDLE_ENABLED — DB config (ImsConfig flag.skill.bundle), default OFF, dev-only. No env var. Flag OFF → 404 (fail-closed; endpoint does not advertise itself).
• Auth: public, anonymous, read-only over PUBLISHED tutorials — mirrors the /provenance endpoint.
• Route ordering: registered after /provenance and before the /content/tutorials/*slug wildcard so the wildcard cannot swallow it (covered by a smoke test).
• Fail-open on sub-data: missing/failed assert specs or provenance degrade the bundle (empty checks, confidence: unknown) rather than failing the request.
• Builds on merged feat(2245): signed provenance envelope for served tutorials #2256 (signed provenance envelope) and feat(2245): assert blocks → parse + persist #2259 (assert blocks → parse + persist). No new persistence — pure read/compose.

Files

• srv/lib/skill-bundle.js — handler factory + buildSkillMd + buildVerifyScript + loadAssertSpecs
• srv/server.js — route registration
• srv/lib/feature-flags/registry.js — SKILL_BUNDLE_ENABLED
• scripts/check-srv-qa-route-drift.ts — srv-only allowlist entry
• tests: test/unit/skill-bundle-compose.test.js, test/lib/skill-bundle-endpoint.test.js, test/unit/check-srv-qa-route-drift.test.ts, test/smoke/express-route-mutations.test.js

Tests

36/36 branch-owned tests pass, including shell-injection tests for verify.sh generation (curl -X <method>, echo labels, assert values all shell-quoted).

Spec: docs/superpowers/specs/2026-09-11-skill-bundle-endpoint-design.md

🤖 Generated with Claude Code