feat(sync): pull canonical agent skills from the protocol tarball

[bokelley]

Summary

Companion PR to adcontextprotocol/adcp#3097 (merged). Wires scripts/sync-schemas.ts to extract protocol-managed agent skills from /protocol/<version>.tgz alongside schemas and compliance.

• Manifest-driven (manifest.contents.skills) and per-name. Only the seven protocol-managed skills (call-adcp-agent, plus adcp-{brand,creative,governance,media-buy,si,signals}) are overwritten on each sync. SDK-local skills (build-seller-agent, build-creative-agent, the legacy adcp CLI skill, etc.) stay untouched.
• Nested schemas/ subdirs inside each per-protocol skill are filtered out — the spec repo bundles them for self-contained agent consumption, but @adcp/client already has the canonical schemas in schemas/cache/<version>/, so re-copying would inflate the package by ~1.4MB per protocol with no functional gain. Filtered: ~80KB total across all seven skills.
• ADCP_BASE_URL env override added (defaults to https://adcontextprotocol.org) so CI / local dev can point sync at a fake CDN for testing.
• The buyer-side call-adcp-agent skill is now sourced from the spec repo rather than maintained as a local copy — version-pinned to ADCP_VERSION, Sigstore-verified via the same cosign path as schemas, no manual sync.

What changes for end users of @adcp/client

• After running npm run sync-schemas, node_modules/@adcp/client/skills/ contains the buyer + per-protocol skills version-aligned with the bundled schemas.
• Coding agents (Claude Code, Cursor, Cline) discovering skills in the SDK package now see the canonical content from the spec repo — no more drift between the SDK's hand-maintained call-adcp-agent and what the spec actually says.

Test plan

• npx tsc --noEmit clean
• End-to-end sync against a local CDN serving a release-built tarball:
  • All seven protocol-managed skills extracted (SYNCED=7)
  • SDK-local skills (adcp/, build-*) untouched (verified by pre-populating a marker file)
  • call-adcp-agent/SKILL.md replaced with canonical (frontmatter adcp_version: "3.x", type: cross-cutting)
  • Nested schemas/ subdirs filtered: 1 file per skill, ~80K total vs. 1.4MB+ per protocol unfiltered
• Once the canonical https://adcontextprotocol.org/protocol/latest.tgz deploy completes (in flight from adcp@49420b101), npm run sync-schemas against production picks up skills

Follow-ups (separate issues, separate SDKs)

• adcp-client-python — extend its sync path to extract skills/ (issue to be filed)
• adcp-go — equivalent (issue to be filed)
• Once stable, consider adding skills[].sha256 to the manifest so SDK consumers can detect skill-only changes between versions without diffing files (DX-expert recommendation from the upstream review).

🤖 Generated with Claude Code