Implement scripts, fixtures, workflows, and docs

Completes the v1 action:

scripts/
  detect-changes.sh   — find SKILL.md paths for PR, issue_comment, push events
  evaluate-backend.sh — free-tier mode; calls api.skill-lab.dev endpoints
  evaluate-cli.sh     — BYOK mode; pip installs sklab and shells to it
  apply-optimize.sh   — reads markers from last comment, commits to PR branch
  build-comment.sh    — renders unified results JSON into PR markdown
  upsert-comment.sh   — PATCH-or-POST via sklab-action marker, fork-safe fallback

tests/fixtures/
  good-skill/, bad-skill/, malicious-skill/ — exercise all gates

.github/workflows/
  test.yml    — self-test matrix against the fixtures
  release.yml — moves v<major> tag on release:published

README.md — inputs/outputs tables, 6 example workflows, troubleshooting,
            results schema for downstream consumers

Author: 8ddieHu0314

.github/workflows/release.yml

@@ -0,0 +1,37 @@
+name: Release
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: write
+
+jobs:
+  retag:
+    name: Move major tag
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Move v<major> tag to this release
+        env:
+          TAG_NAME: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          # Accept v1.2.3, v1.2, v1 — extract the leading vN.
+          if [[ ! "$TAG_NAME" =~ ^v[0-9]+ ]]; then
+            echo "Release tag '$TAG_NAME' does not start with vN; skipping major-tag move"
+            exit 0
+          fi
+          MAJOR="$(echo "$TAG_NAME" | grep -oE '^v[0-9]+')"
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          git tag -f "$MAJOR" "$TAG_NAME"
+          git push origin "$MAJOR" --force
+
+          echo "Moved $MAJOR → $TAG_NAME"

.github/workflows/test.yml

@@ -0,0 +1,82 @@
+name: Self-test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  # Review mode — static + security. No LLM, no API key.
+  review-good:
+    name: review · good-skill (expect pass)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./
+        id: run
+        with:
+          mode: review
+          path: tests/fixtures/good-skill
+          comment: false
+      - run: |
+          echo "any-failed=${{ steps.run.outputs.any-failed }}"
+          echo "skills-count=${{ steps.run.outputs.skills-count }}"
+
+  review-bad:
+    name: review · bad-skill (informational, low score expected)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./
+        id: run
+        with:
+          mode: review
+          path: tests/fixtures/bad-skill
+          comment: false
+          fail-threshold: "0"   # informational; don't fail the job
+      - run: |
+          echo "any-failed=${{ steps.run.outputs.any-failed }}"
+
+  # Security gate must trip on the malicious fixture.
+  review-malicious:
+    name: review · malicious-skill (expect BLOCK)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./
+        id: run
+        continue-on-error: true
+        with:
+          mode: review
+          path: tests/fixtures/malicious-skill
+          comment: false
+          security-gate: "true"
+      - name: Expect security failure
+        run: |
+          if [ "${{ steps.run.outputs.any-failed }}" != "true" ]; then
+            echo "::error::Expected security-gate to fail on malicious-skill, got any-failed='${{ steps.run.outputs.any-failed }}'"
+            exit 1
+          fi
+
+  # Judge mode hits the backend. Skipped if backend is unreachable at test time.
+  judge-backend:
+    name: judge · good-skill (backend LLM)
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./
+        id: run
+        continue-on-error: true
+        with:
+          mode: judge
+          path: tests/fixtures/good-skill
+          comment: false
+      - run: |
+          echo "any-failed=${{ steps.run.outputs.any-failed }}"
+          echo "total-cost=${{ steps.run.outputs.total-cost }}"