feat(skills): carry the changepacks skill and report what a .changepacks directory obliges

[owjs3901]

Why

Agents using devup-mcp open pull requests without a changepack log. Investigating it, the cause turned out to be documentation, not the agent.

changepacks documents the bare command:

changepacks   # "opens an interactive session to select changed projects and write release notes"

In an agent shell, a CI job, or any non-TTY context, that hangs or is cancelled. So the step is skipped, the version never moves, and the change reaches the base branch unreleased.

The non-interactive form already existed, documented nowhere a reader would find it while writing a PR:

bunx @changepacks/cli --yes --update-type patch --message "..."

Two halves

1. Carry the skill

changepacks/changepacks#131 adds a consumer-facing SKILL.md that leads with the non-interactive form. This vendors it as an embedded skill, so devup_skills install delivers it with no network.

Apache-2.0 makes the redistribution fine. This is the first carried skill from outside dev-five-git, which is what broke the two tests below.

2. Report the obligation — the more important half

A skill only helps a caller who installed and loaded it. The PR that lacks a changepack comes from the caller who never thought to ask.

devup_skills now returns a repoObligations.changepacks block whenever the workspace has a .changepacks/ directory. Real output against this repository:

{
  "detected": "...\\devup-mcp\\.changepacks",
  "obligation": "A pull request that changes a tracked path must add a changepack log. Without one the version never moves, so the change reaches the base branch and is never released.",
  "createWith": "bunx @changepacks/cli --yes --update-type <major|minor|patch> --message \"<why this change exists>\"",
  "whyNotBare": "Running the tool with no flags opens an interactive selection UI, which hangs or is cancelled in a non-TTY shell...",
  "tracks": ["**", "!/crates/*/Cargo.toml"],
  "tracksNote": "Patterns from .changepacks/config.json. A leading `!` marks a tracked path... decided by this list, not by a general rule.",
  "baseBranch": "main",
  "pendingLogs": ["changepack_log_reset_css_needs_no_config.json"],
  "skill": "changepacks"
}

The tracked patterns are read from the config, never assumed — which paths need a changepack differs per repository (["**", "!/crates/*/Cargo.toml"] here, ["*", "!packages/*/*", ...] in devup-ui).

instructions already tells every session to call devup_skills before writing devup-ui code, so this arrives without anyone asking for it. That is what makes it apply just by installing the MCP.

Test fix

Two tests had dev-five-git spelled into the provenance assertion:

body.contains("Vendored from dev-five-git/")

They failed on the first skill vendored from another organisation. Both derive the repository from the record now, or assert the note's shape rather than an org.

Verification

gate	result
cargo fmt --all -- --check	exit 0
cargo clippy --locked --workspace --all-targets --all-features -- -D warnings	exit 0
cargo test -p devup-mcp --all-features	exit 0
node scripts/refresh-skills.mjs --check	exit 0 — = changepacks: unchanged at ec1f4b025ed7
detection driven over real stdio	repoObligations.changepacks present, config read correctly

This PR's own changepack was created with the exact command the skill teaches, non-interactively, exit 0:

$ bunx @changepacks/cli --yes --update-type minor --message "..."
Found 1 projects

Its key was then aligned to this repo's convention (crates/devup-mcp/Cargo.toml, matching every previous pack) and confirmed with update --dry-run:

[Workspace - Rust] devup-mcp (v0.8.0) - Cargo.toml v0.8.0 → v0.9.0

Release note

This Minor absorbs the pending 0.8.1 patch (the reset-css correction from #67), so the next release is 0.9.0 rather than 0.8.1.