fix(plugins): package Gemini releases and improve OAuth (#94)

## Summary

- preserve the existing `agentkey.skill` GitHub Release asset and add
platform-named Gemini extension archives for macOS, Linux, and Windows
- opt the Gemini extension into native first-connect OAuth with
`oauth.enabled`, while keeping `/mcp auth agentkey` as the manual retry
path
- add explicit Gemini, Antigravity 2.0, and Antigravity CLI
authentication and connection-verification guidance
- explain Gemini's user-Skill precedence warning and avoid duplicate MCP
registrations when an extension or plugin already owns the server entry
- add regression coverage and trigger the scripts test workflow when
authentication guidance or release packaging changes

## Root causes

Gemini CLI treats a lone generic GitHub Release asset as the extension
archive. AgentKey releases currently publish only `agentkey.skill`, but
Gemini CLI extracts only `.tar.gz` and `.zip` extension archives. After
that extraction failure, Gemini retries Git clone in the same non-empty
temporary directory and fails again.

Separately, the Gemini manifest omitted `oauth.enabled`. Gemini
discovered that AgentKey required OAuth, but only reported `/mcp auth
agentkey` instead of starting the browser flow automatically. A
pre-existing user Skill at `~/.agents/skills/agentkey` can also override
the extension-bundled Skill, hiding new setup guidance even though the
extension MCP entry is active.

## Authentication design

- Gemini uses `httpUrl` plus `oauth.enabled: true`; OAuth endpoints and
client registration remain dynamically discovered.
- Antigravity keeps the documented credential-free `serverUrl`
configuration and uses DCR through its native Authenticate controls.
- No static access token, Authorization header, OAuth client secret, or
hard-coded authorization endpoint is added to either package.

## Validation

- Bats suite: 27/27 passing
- `gemini extensions validate .`
- built and inspected `agentkey.skill`, `darwin.agentkey.tar.gz`,
`linux.agentkey.tar.gz`, and `win32.agentkey.zip`
- verified both Gemini platform archive formats contain `oauth.enabled:
true`, `gemini-extension.json`, and `skills/agentkey/SKILL.md`
- validated workflow YAML, shell syntax, archive roots, manifest
invariants, and `git diff --check`
- verified the live AgentKey endpoint advertises protected-resource
metadata, PKCE, and a dynamic client registration endpoint

## Release coordination

Merge this fix before release PR #92 so the first Gemini-enabled release
publishes compatible archives and the corrected first-connect OAuth
behavior.

---------

Co-authored-by: Allen <0xfatdog@gmail.com>

scripts/build-release-assets.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+OUTPUT_ARG="${1:-dist/release-assets}"
+
+case "$OUTPUT_ARG" in
+    /*) OUTPUT_DIR="$OUTPUT_ARG" ;;
+    *) OUTPUT_DIR="$REPO_ROOT/$OUTPUT_ARG" ;;
+esac
+
+for command_name in git tar unzip zip; do
+    if ! command -v "$command_name" >/dev/null 2>&1; then
+        echo "Required command not found: $command_name" >&2
+        exit 1
+    fi
+done
+
+mkdir -p "$OUTPUT_DIR"
+
+ASSET_NAMES=(
+    agentkey.skill
+    darwin.agentkey.tar.gz
+    linux.agentkey.tar.gz
+    win32.agentkey.zip
+)
+
+for asset_name in "${ASSET_NAMES[@]}"; do
+    rm -f "$OUTPUT_DIR/$asset_name"
+done
+
+(
+    cd "$REPO_ROOT/skills/agentkey"
+    zip -qr "$OUTPUT_DIR/agentkey.skill" . \
+        -x "*.DS_Store" \
+        -x "__pycache__/*" \
+        -x "*.pyc"
+)
+
+git -C "$REPO_ROOT" archive \
+    --format=tar.gz \
+    --output="$OUTPUT_DIR/darwin.agentkey.tar.gz" \
+    HEAD
+cp "$OUTPUT_DIR/darwin.agentkey.tar.gz" "$OUTPUT_DIR/linux.agentkey.tar.gz"
+git -C "$REPO_ROOT" archive \
+    --format=zip \
+    --output="$OUTPUT_DIR/win32.agentkey.zip" \
+    HEAD
+
+for archive_name in darwin.agentkey.tar.gz linux.agentkey.tar.gz; do
+    tar -tzf "$OUTPUT_DIR/$archive_name" | grep -Fx 'gemini-extension.json' >/dev/null
+    tar -tzf "$OUTPUT_DIR/$archive_name" | grep -Fx 'skills/agentkey/SKILL.md' >/dev/null
+done
+
+unzip -Z1 "$OUTPUT_DIR/win32.agentkey.zip" | grep -Fx 'gemini-extension.json' >/dev/null
+unzip -Z1 "$OUTPUT_DIR/win32.agentkey.zip" | grep -Fx 'skills/agentkey/SKILL.md' >/dev/null
+unzip -Z1 "$OUTPUT_DIR/agentkey.skill" | grep -Fx 'SKILL.md' >/dev/null
+
+echo "Built release assets:"
+for asset_name in "${ASSET_NAMES[@]}"; do
+    echo "  $OUTPUT_DIR/$asset_name"
+done