fix: skill follow-ups from review

allowed-tools now pre-grants make and gh, matching the commands the
skill body runs. The raw-URL fallback tells agents to fetch reference
files from the same ref as SKILL.md instead of pointing at main, so a
pinned skill can't mix with newer references. updating.md gains skill
activation smoke checks (positive, negative, explicit invocation)
before any release touching the skill.

https://claude.ai/code/session_01T3RGHgchJZBpvuiesrrE7X

Author: claude

skills/simple-modern-uv/SKILL.md

@@ -12,7 +12,7 @@ compatibility: Requires git and uv (https://docs.astral.sh/uv/); network access
 metadata:
   author: jlevy (github.com/jlevy)
   source: https://github.com/jlevy/simple-modern-uv
-allowed-tools: Bash(uvx:*), Bash(uv:*), Bash(git:*), Read, Write, Edit
+allowed-tools: Bash(uvx:*), Bash(uv:*), Bash(git:*), Bash(make:*), Bash(gh:*), Read, Write, Edit
 ---
 # simple-modern-uv: Modern Python Project Setup
 
@@ -37,9 +37,9 @@ For all workflows: when something fails, check [references/faq.md](references/fa
 before improvising. For post-setup customization (license change, private/unpublished
 package, entry points), see [references/customize.md](references/customize.md).
 
-If this file was fetched from a URL rather than installed as a folder, the reference
-files are at
-`https://raw.githubusercontent.com/jlevy/simple-modern-uv/main/skills/simple-modern-uv/references/<name>.md`.
+If this file was fetched from a URL rather than installed as a folder, fetch the
+reference files from the **same ref**: replace `SKILL.md` in the URL you used with
+`references/<name>.md` (don’t mix a pinned `SKILL.md` with references from `main`).
 
 ## The Interview: What to Ask the User (and What Not to Ask)
 

updating.md

@@ -202,6 +202,16 @@ and template code. This is the real end-to-end validation that the template work
 
 If CI fails, fix issues in the template repo and repeat from Step 2.
 
+### Skill Activation Checks
+
+Before releasing changes that touch `skills/simple-modern-uv/`, smoke-test activation in
+at least one target agent (CI validates structure and links, not activation):
+
+- A new-project prompt ("start a new Python project called X") activates the skill
+- A migration prompt ("convert this Poetry project to uv") activates the skill
+- An unrelated Python prompt ("debug this stack trace") does *not* activate it
+- Explicit invocation (`/simple-modern-uv` or the agent’s equivalent) loads cleanly
+
 ## Step 7: Create a Release on the Template Repo
 
 Once CI passes downstream (and this repo’s own CI is green on the candidate commit),