feat(skill-store): report Hub install-success after local fetch commit

[autogame-17]

Summary

After evolver fetch --skill successfully writes a Hub skill to disk, POST Hub /a2a/skill/store/:id/install-success so B-5 / KDP-3 trailing-30d unique-install trending can populate.

Scope and cuts

Outcome: Evolver clients that complete a local Hub skill install commit now emit install-success (fail-soft; disk write already landed).

Cuts / 缩减的范围:

1. Website market Download — unlocks in-browser content preview only; not a local install commit (sidebar already points users to evolver fetch --skill). Owner: website.
2. Desktop in-app Hub Skill Store install — still opens evomap.ai/market/skill/:id externally (#8128); no local Hub install commit path yet. Owner: desktop plugins.
3. Personalized Hub Top-5 remote recommend, KB local, lane37/38 leftovers — separate Cuts.

What changed

• New src/gep/skillInstallSuccess.js helper + focused tests
• index.js fetch path gates on skillInstallCommitted then reports with node_secret auth
• README EN/zh note

How to test

node --test test/skillInstallSuccess.test.js test/fetchSecurity.test.js

Risk

Low — additive fail-soft Hub POST after successful local write; download path unchanged.

Harness/evaluator governance

Upstream governance surface: src/gep/skillInstallSuccess.js Hub Skill Store client confirm only (post-local-commit install-success POST); no GEP schema, selector, mutation, solidify, evaluator, or evolve-pipeline change.
Downstream EvoX impact: Desktop/website still do not install Hub skills locally; when they shell out to evolver fetch --skill, trending can populate. No Wails/bridge/protocol contract change in this PR.
Rollout-local scope: Applies only after a successful on-disk skill write from evolver fetch --skill; report failures are fail-soft and leave local files intact.
Promotion boundary: Merge makes install-success reporting the default for the fetch--skill path only; no live Hub ranking promotion or evaluator promotion is performed by this PR.
Evaluator mismatch sets: Observation unchanged for evolution candidates; action adds one authenticated Hub confirm after local install commit; repair none (fail-soft skip); verification covers helper unit tests plus source-level wiring/fetch security guards; evidence is focused node --test output; belief unchanged for harness approval/scoring.
Non-regression evidence: node --test test/skillInstallSuccess.test.js test/fetchSecurity.test.js (10/10 pass); download path and path-traversal guards unchanged.
Fix-severity review: low
Owner approval: Skill Store / Hub A2A client owner review sufficient; no evaluator owner sign-off required.
Security boundary: Reuses existing node_secret Hub auth and hubFetch egress; body is { sender_id } only — no transcript, KB, filenames, or prompt content uploaded.
Rollback: Revert this PR; local fetch continues to write skills without reporting.
Live promotion: no
Autonomous evaluator self-editing: no

Self-check

• No new runtime dependencies
• New src/gep/skillInstallSuccess.js follows sibling plain-source gep client modules (no public.manifest in this package layout)

[evomap-aiqa-bot]

Sentinel 正在审核此变更，尚未形成最终结论。

大 PR 拆片审核中

• Sentinel 判断这个 PR 规模较大，已经拆成多个 slice 分别审核，所以会比普通 PR 花更久。
• 当前 check 会保持进行中；这不是绿色通过，也不是红色阻塞。
• Sentinel 会继续完成 slice review、Cross-Slice Verifier 和聚合；如果后续发现红区问题，会更新本 head 的审核结论。
• 规模等级: large
• Slice 数量: 6

开发 agent 查询详情： 调用 MCP 工具 sentinel_pr_review_context，传入 owner_repo="evomap/evolver"、pr_number=622、head_sha="6e8c0555dca835ec63ddb834781f127c80d50ca6"，并按条目追加 finding_id 或 finding_key。

由 Sentinel 审核 · 目标提交 6e8c0555dca8

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.