Reproduce agent-skills MCP setup via chezmoi

[DROOdotFOO]

Summary

Makes the DROOdotFOO/agent-skills MCP agents and skills fully reproducible via chezmoi apply. Previously two pieces were provisioned out-of-band and a fresh setup would leave ~/.mcp.json pointing at binaries that don't exist.

Closes two gaps:

1. Agent CLIs weren't installed by chezmoi. The 9 agent CLIs (digest, recall, ... regen) were hand-installed via pip install -e into mise Python 3.10.13. Added:

   • run_once_before_10-clone-agent-skills.sh.tmpl — clones agent-skills if absent (guarded; never touches an existing working clone).
   • run_onchange_after_setup-agents.sh.tmpl — editable-installs shared + scribe + the flag-enabled agents into mise Python, then mise reshim. Named setup-agents so it sorts after mise-install (which provisions Python). Re-runs when any agent pyproject.toml changes.

2. virtuals-protocol-acp was out-of-repo. A third-party skill present in ~/.agents/skills/ but not in the agent-skills tarball, so the archive external never recreated it (and a refresh can clobber it). Vendored it into dot_agents/skills-extra/ — a sibling dir the external does not own — and extended run_after_sync-skills.sh.tmpl to link both ~/.agents/skills/ and ~/.agents/skills-extra/ (with skills/ winning name clashes).

Uses built-in {{ .chezmoi.homeDir }}/CODE/agent-skills rather than a new .chezmoi.toml.tmpl data var, since new data vars don't auto-propagate to the live config and would trip missingkey=error.

The signoz Go binary remains a documented one-time bootstrap step (scripts/setup/setup-signoz-mcp.sh), not an apply-time build.

Manual testing

• All 3 scripts render via chezmoi execute-template and pass shellcheck -s bash
• run_onchange_after_setup-agents ran end-to-end (~21s); all 9 CLIs on PATH; recall stats, digest list-platforms, regen --help exit 0
• regen gains a mise shim after mise reshim (previously had none)
• Vendored skill materializes to ~/.agents/skills-extra/virtuals-protocol-acp/
• run_after_sync-skills produces 59 clean skill links, no broken links
• Isolated test confirms skills-extra skills link correctly when absent from skills/, skills/ wins clashes, and stale links are pruned