Export immutable skill bundles for restricted runners

[Scriptception]

Problem

Restricted automation such as Review Bot cannot safely enable dynamic plugin discovery, package managers, network access, or mutable user configuration at runtime.

User outcome

A privileged consumer can receive a pre-reviewed, immutable, minimal skill artifact without expanding its runtime trust boundary.

Scope

• Define an export format containing selected rendered instructions, provenance, capabilities, digests, and evaluation references.
• Support deterministic rendering for a named restricted-runner profile.
• Exclude installers, executable helpers, network resolution, and runtime catalog access by default.
• Document consumer-side verification requirements.

Non-goals

• Loading Skilldeck plugins dynamically inside Review Bot.
• Granting a reviewer shell, network, or credential access.
• Coupling Skilldeck to one privileged consumer.

Acceptance criteria

• Repeated export from the same lockfile is byte-identical.
• The artifact contains only declared selected files and verifiable metadata.
• Consumer verification detects modification or wrong publisher.
• A restricted-runner fixture can load the artifact with all dynamic integrations disabled.

Validation

• Compare exports across clean environments.
• Tamper with content, metadata, and digest references and verify rejection.

Relationships

• Depends on bundles, lockfiles, capabilities, provenance, and evaluation evidence.
• Enables a future Review Bot integration without weakening its isolation model.