chore(skills): add release-widget skill

[yordan-st]

Summary

• Adds `.agents/skills/release-widget/SKILL.md` — automates widget/module release pipeline (version bump → GitHub draft release → OSS clearance → Marketplace publish)
• Previously ran as private trial (untracked); opening as draft for team feedback before promoting to shared skill set

Test plan

• Used successfully for image-web v1.6.0 and charts-web v6.3.2 releases

[github-actions]

AI Code Review

⚠️ Approved with suggestions — low-severity items only, safe to merge

---

What was reviewed

File	Change
.agents/skills/release-widget/SKILL.md	New skill — 8-phase release workflow guide
automation/utils/bin/rui-bump-version.ts	New CLI: version bump with releasability guard
automation/utils/bin/rui-changelog.ts	New CLI: unreleased changelog reader
automation/utils/bin/rui-create-jira-version.ts	New CLI: Jira version creation (non-blocking)
automation/utils/bin/rui-generate-oss-sbom.ts	New CLI: SBOM zip generator
automation/utils/bin/rui-oss-clearance.ts	Refactor: extracted computeHash → computeSha256 in oss-clearance.ts
automation/utils/bin/rui-package-info.ts	New CLI: prints package metadata from process.cwd()
automation/utils/bin/rui-upload-readme-oss.ts	New CLI: attaches READMEOSS asset to a GitHub release
automation/utils/package.json	Registers 6 new bin entries
automation/utils/src/bump-version.ts	Refactor: bumpPackageJson now verifies written version; added packageXmlPath/hasPackageXml
automation/utils/src/changelog-parser/index.ts	New getPackageChangelog factory + import getPackageInfo
automation/utils/src/github.ts	New GitHubRelease type; getReleaseByTag falls back to list for drafts; listReleases extracted
automation/utils/src/monorepo.ts	New resolvePackagePath helper
automation/utils/src/oss-clearance.ts	computeSha256 + verifyAssetDigest extracted here
automation/utils/src/package-info.ts	New isReleasable guard
automation/utils/src/prepare-release-helpers.ts	Uses getPackageChangelog instead of inline if/else
automation/utils/src/version.ts	Bug fix: bumpMajor increments major (not minor); new isGreaterThan

Skipped (out of scope): dist/, pnpm-lock.yaml

---

Findings

⚠️ Low — listReleases silently truncates at 100 releases

File: automation/utils/src/github.ts line 198–205
Note: ?per_page=100 is hard-coded and no pagination follows. A repo with more than 100 releases (web-widgets currently has dozens, so not urgent) will silently miss older drafts in the fallback path of getReleaseByTag. Consider adding a note or a TODO comment, or paging when releases.length === 100.

---

⚠️ Low — bumpXml regex can silently no-op on unexpected package.xml formats

File: automation/utils/src/bump-version.ts line 59–61
Note: The regex /version=.+xmlns/ replaces the first occurrence of version=…xmlns. If the file format ever changes (e.g. xmlns comes before version), the file is written back unchanged with no error. bumpPackageJson validates the write — bumpXml does not. Returning true unconditionally gives false confidence. Low risk today but worth a read-back check or at least a mismatch error similar to what bumpPackageJson does.

---

⚠️ Low — SKILL.md Phase 0 cd hard-codes pluggableWidgets/ path for modules

File: .agents/skills/release-widget/SKILL.md line 29–30
Note: The example cd packages/pluggableWidgets/<widget> at the top of Phase 0 only covers widget packages. Module packages live under packages/modules/<name>. An agent following the example literally for a module like data-widgets would cd to the wrong path. A one-line clarification (or an example covering both layouts) would prevent the confusion.

---

Positives

• bumpMajor bug fix (this.major + 1 instead of this.minor + 1) is well-targeted and the added isGreaterThan gives it a proper test surface.
• getReleaseByTag fallback to listReleases for draft releases is exactly the right approach and the comment explains the non-obvious reason (releases/tags/ 404s for drafts).
• verifyAssetDigest correctly handles a missing asset.digest field (optional check) rather than throwing on a null digest — good defensive coding for GitHub API field variability.
• rui-create-jira-version always exits 0 for non-usage errors and outputs structured {status, reason} — the design deliberately avoids blocking a release on a non-critical external system.
• Phase 8 rollback gate (human-gated, always — carve-out does not apply here) is clearly stated and enforced at the skill level.
• getPackageChangelog eliminates a repeated if (changelogType === "widget") branch at every call site; the consolidation in prepare-release-helpers.ts is clean.