feat: advertise and serve agent skills from .well-known - #44878

…45641)

## Summary

This PR makes `fetchAgentSkills.mjs` a spec-compliant client of the
[agent-skills `.well-known` URI
spec](agentskills/agentskills#254), and updates
the script to match the current release structure in
[`supabase/agent-skills`](https://github.com/supabase/agent-skills).

---

## 1. Spec-compliant URL resolution and digest verification

`fetchAgentSkills.mjs` acts as a client consuming the `.well-known`
discovery index. The [agent-skills `.well-known`
spec](agentskills/agentskills#254) is explicit
on two points:

**URL resolution** — skill artifact URLs in `index.json` must be
resolved per [RFC 3986
§5.2.2](https://datatracker.ietf.org/doc/html/rfc3986#section-5.2.2)
using the index URL as the base URI:

> "The `url` field specifies where to fetch the skill artifact. URLs are
resolved per RFC 3986 Section 5 using the index URL as the base URI."

This means `skill.url` can be relative (`supabase.tar.gz`),
path-absolute (`/.well-known/agent-skills/supabase.tar.gz`), or fully
absolute (e.g. a CDN URL like
`https://cdn.example.com/supabase.tar.gz`). The previous implementation
extracted a filename with `.split('/').pop()` which happened to work for
bare relative URLs but was not doing RFC 3986 resolution.

**Digest verification** — clients must verify artifact integrity before
use:

> "Clients **must** verify downloaded content against the `digest` in
the index. A mismatch indicates the content is corrupted or tampered
with — clients **must not** use unverified content."

The updated script uses `new URL(skill.url, githubReleaseIndexUrl)` for
compliant resolution, verifies each artifact's SHA-256 digest from the
in-memory buffer before any disk writes, and only writes to
`public/.well-known/agent-skills/` once all digests pass.

**Acknowledged overhead**: since Supabase owns both the publisher
([`scripts/build-release.ts`](https://github.com/supabase/agent-skills/blob/main/scripts/build-release.ts)
in `supabase/agent-skills`) and this consumer, the practical risk of
non-compliant URL handling is currently low — the publisher always emits
bare relative filenames. However, being spec-compliant here gives us
full flexibility to change how skills are packaged or hosted in
`supabase/agent-skills` in the future (e.g. moving artifacts to a CDN)
without needing to update this script.

---

## 2. Semver release tags

#44878 referenced `supabase/agent-skills#66` (date+SHA tags).
[supabase/agent-skills#77](supabase/agent-skills#77)
has since merged, moving releases to semver tags managed by Release
Please. `/releases/latest` works for both formats — no code change
needed, just a rebase.

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>