fix(plugins): package Gemini releases and improve OAuth (#94)

## Summary

- preserve the existing `agentkey.skill` GitHub Release asset and add
platform-named Gemini extension archives for macOS, Linux, and Windows
- opt the Gemini extension into native first-connect OAuth with
`oauth.enabled`, while keeping `/mcp auth agentkey` as the manual retry
path
- add explicit Gemini, Antigravity 2.0, and Antigravity CLI
authentication and connection-verification guidance
- explain Gemini's user-Skill precedence warning and avoid duplicate MCP
registrations when an extension or plugin already owns the server entry
- add regression coverage and trigger the scripts test workflow when
authentication guidance or release packaging changes

## Root causes

Gemini CLI treats a lone generic GitHub Release asset as the extension
archive. AgentKey releases currently publish only `agentkey.skill`, but
Gemini CLI extracts only `.tar.gz` and `.zip` extension archives. After
that extraction failure, Gemini retries Git clone in the same non-empty
temporary directory and fails again.

Separately, the Gemini manifest omitted `oauth.enabled`. Gemini
discovered that AgentKey required OAuth, but only reported `/mcp auth
agentkey` instead of starting the browser flow automatically. A
pre-existing user Skill at `~/.agents/skills/agentkey` can also override
the extension-bundled Skill, hiding new setup guidance even though the
extension MCP entry is active.

## Authentication design

- Gemini uses `httpUrl` plus `oauth.enabled: true`; OAuth endpoints and
client registration remain dynamically discovered.
- Antigravity keeps the documented credential-free `serverUrl`
configuration and uses DCR through its native Authenticate controls.
- No static access token, Authorization header, OAuth client secret, or
hard-coded authorization endpoint is added to either package.

## Validation

- Bats suite: 27/27 passing
- `gemini extensions validate .`
- built and inspected `agentkey.skill`, `darwin.agentkey.tar.gz`,
`linux.agentkey.tar.gz`, and `win32.agentkey.zip`
- verified both Gemini platform archive formats contain `oauth.enabled:
true`, `gemini-extension.json`, and `skills/agentkey/SKILL.md`
- validated workflow YAML, shell syntax, archive roots, manifest
invariants, and `git diff --check`
- verified the live AgentKey endpoint advertises protected-resource
metadata, PKCE, and a dynamic client registration endpoint

## Release coordination

Merge this fix before release PR #92 so the first Gemini-enabled release
publishes compatible archives and the corrected first-connect OAuth
behavior.

---------

Co-authored-by: Allen <0xfatdog@gmail.com>

.github/workflows/release-please.yml

@@ -22,29 +22,28 @@ jobs:
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
 
-  publish-skill-asset:
+  publish-release-assets:
     needs: release-please
     if: ${{ needs.release-please.outputs.release_created == 'true' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.release-please.outputs.tag_name }}
 
-      - name: Build agentkey.skill zip
-        run: |
-          cd skills/agentkey
-          zip -r "$GITHUB_WORKSPACE/agentkey.skill" . \
-            -x "*.DS_Store" \
-            -x "__pycache__/*" \
-            -x "*.pyc"
-          echo "--- contents ---"
-          unzip -l "$GITHUB_WORKSPACE/agentkey.skill"
+      - name: Build Skill and Gemini extension assets
+        run: scripts/build-release-assets.sh dist/release-assets
 
-      - name: Upload asset to release
+      - name: Upload assets to release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ needs.release-please.outputs.tag_name }}
         run: |
-          gh release upload "$TAG" agentkey.skill \
+          gh release upload "$TAG" \
+            dist/release-assets/agentkey.skill \
+            dist/release-assets/darwin.agentkey.tar.gz \
+            dist/release-assets/linux.agentkey.tar.gz \
+            dist/release-assets/win32.agentkey.zip \
             --repo "$GITHUB_REPOSITORY" \
             --clobber
 

.github/workflows/scripts-test.yml

@@ -3,18 +3,31 @@ on:
   push:
     paths:
       - 'skills/agentkey/scripts/**'
+      - 'scripts/build-release-assets.sh'
+      - 'skills/agentkey/SKILL.md'
+      - 'skills/agentkey/references/setup.md'
       - 'gemini-extension.json'
       - 'plugin.json'
       - 'mcp_config.json'
+      - 'README.md'
+      - 'docs/README_zh.md'
       - 'tests/**'
+      - '.github/workflows/release-please.yml'
       - '.github/workflows/scripts-test.yml'
   pull_request:
     paths:
       - 'skills/agentkey/scripts/**'
+      - 'scripts/build-release-assets.sh'
+      - 'skills/agentkey/SKILL.md'
+      - 'skills/agentkey/references/setup.md'
       - 'gemini-extension.json'
       - 'plugin.json'
       - 'mcp_config.json'
+      - 'README.md'
+      - 'docs/README_zh.md'
       - 'tests/**'
+      - '.github/workflows/release-please.yml'
+      - '.github/workflows/scripts-test.yml'
 
 jobs:
   bats: