Kits: ship the patterns repo's own skills + pattern-router as an acq kit (with provenance)

[wz-gsa]

Problem

Today the acq/sbx kits clone the playbook repo's .agents/skills into sandboxes (via playbook-clone.sh). The patterns repo's own skills (secure-code-review, the frontend/USWDS set, communications, the pattern-router skill, etc.) and scripts/route_patterns.py are a contributor-local toolchain — they never reach a sandbox/model through the kits approach. The user's goal is to inject/add all our skills easily and surface them to all models via kits.

Proposal (consensus 7/7 approved)

Add a neutral hybrid/v1 acq kit (e.g. acq-kits/agentic-coding-patterns) that, at sandbox startup:

1. Fetches the patterns repo at a pinned full-SHA ref via the GitHub REST tarball (same credential-substitution-safe path as the playbook kit — NOT git clone), verifying a content sha256 over the skills tree.
2. Symlinks each skill dir into the standard roots (~/.agents/skills, ~/.claude/skills, ~/.cursor/skills, per-agent roots) — flat per Skills: nested skill dirs (frontend/, communications/, outreach/, meta/) may not surface under flat ~/.agents/skills discovery #278.
3. Optionally installs scripts/route_patterns.py + INDEX.yaml + schemas/taxonomy.yaml so the deterministic pattern-router skill works in-sandbox.
4. Records kit-bundle provenance (bundle name, repo, applied ref, timestamp) — reuse the provenance schema added in patterns#273 / quickstart#236 so acq kit check|update can tell a stale patterns-skills bundle from a current one.

Constraints

• Router stays an OPTIONAL deterministic selection aid layered on top of standard progressive-disclosure discovery — model access to skills MUST NOT depend on the router (consensus condition).
• Pin a full 40-char SHA; never fetch mutable main.
• Ensure the linker refuses to overwrite existing skill dirs and does not follow symlinks outside the kit root (security condition).
• Guard against name collisions between the playbook's skills and the patterns' skills in the same shared root.

Acceptance

• A sandbox provisioned with the kit surfaces the patterns skills to OpenCode/Claude/Codex via their skills roots.
• acq kit check reports the patterns-skills bundle status.
• Provenance recorded; SHA-pinned; no mutable fetch.

Depends on #277 (name/description conformance) and #278 (flat layout). Relates to quickstart#235/#236 (provenance).

AI-assisted (OpenCode); consensus-reviewed. Requires human review.