fix(ci): skills sync publishes hyperframes-creative past its hidden 1.0.13 and checks it went live (#5081)

* fix(ci): skills sync publishes past a version the registry holds unpublished

* fix(ci): skills sync fails unless a republished skill is the registry's latest

* fix(ci): skills sync republishes one patch past a hidden version and checks it as owner

* test(ci): skills sync fails the job on an error and stops after a clean sync

Two mutants survived review: dropping the line that sets the exit code (the job would print its ::error:: lines and still pass) and dropping the clean-sync return. One test runs the script with a failing fake clawhub on PATH and expects exit 1; another pins that a clean sync makes no further call.

* test(ci): the exit-code test can only reach its fake clawhub

The child's PATH was the fake's folder plus the inherited PATH, so on a machine where the fake cannot execute, a real logged-in clawhub further down would run sync for real. PATH is now the fake's folder alone.

* fix(ci): skills sync skips only hyperframes-creative's hidden 1.0.13

Republishing one patch past any taken version would publish past every future hidden version with no one looking. Only the acknowledged case (hyperframes-creative, 1.0.13 taken) is published at 1.0.14; any other taken version fails the sync as before.

* test(ci): the skip allowlist matches the skill, not just the version

A taken 1.0.13 on any other skill must fail the sync too; without this case, accepting 1.0.13 for every skill passed all tests.

* refactor(ci): skills sync picks the republish version in its own helper

The allowlist check took republishTaken to cyclomatic 5, which the Fallow audit scores at its 30.0 CRAP threshold; deciding the version in versionPastSkippable keeps each function under it. Behaviour unchanged.

.github/workflows/sync-skills-to-clawhub.yml

@@ -10,6 +10,7 @@ on:
     branches: [main]
     paths:
       - "skills/**"
+      - "scripts/clawhub-sync.mjs"
   workflow_dispatch:
     inputs:
       dry_run:
@@ -50,17 +51,4 @@ jobs:
       - name: Sync skills
         env:
           DRY_RUN: ${{ github.event.inputs.dry_run }}
-        run: |
-          FLAGS=(
-            --all
-            --owner heygen-com
-            --bump patch
-            --changelog "Synced from ${GITHUB_SHA:0:7} (${GITHUB_REF_NAME})"
-            --source-repo "$GITHUB_REPOSITORY"
-            --source-commit "$GITHUB_SHA"
-            --source-ref "$GITHUB_REF"
-          )
-          if [ "$DRY_RUN" = "true" ]; then
-            FLAGS+=(--dry-run)
-          fi
-          clawhub sync "${FLAGS[@]}"
+        run: node scripts/clawhub-sync.mjs