feat: add hcs-28 scoring support

[kantorcodes]

Summary

• add HCS-28 baseline scoring to validate and monitor flows
• expose HCS-28 data in preview artifacts and action outputs
• cover the new scoring path with tests and live runtime verification

[gemini-code-assist]

Code Review

This pull request introduces the HCS-28 trust scoring system, which evaluates GitHub repository health, verification signals, and metadata to provide a comprehensive trust score for skills. Key additions include new scoring modules (hcs-28.mjs and hcs-28-github-health.mjs), integration into the preview report generation, and updated GitHub Action outputs. Feedback focuses on refining the repository health calculation for small cohorts to avoid misleading scores, optimizing network requests by fetching repository metrics in parallel, and removing redundant file mapping logic in the entrypoint to improve maintainability.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

All three previous issues have been fixed in this commit:

File	Line	Previous Issue	Status
entrypoint.mjs	1236	computeHcs28TrustPreview called without try-catch	FIXED - now wrapped with .catch() handler
bin/lib/hcs-28-github-health.mjs	244	GitHub API requests unauthenticated	FIXED - now adds Bearer token authorization header
bin/lib/hcs-28-github-health.mjs	254	No timeout on fetch calls	FIXED - now has AbortSignal.timeout(10000)

Changes Made

• Added try-catch error handling around HCS-28 computation with graceful fallback
• Added githubToken parameter and Bearer token authorization for GitHub API
• Added 10-second timeout on all fetch calls to prevent hanging
• Refactored to use Promise.all for parallel repo fetching (more efficient)
• Added buildHcs28Fallback function for graceful degradation

Files Reviewed (3 files)

• bin/lib/hcs-28-github-health.mjs
• bin/lib/hcs-28.mjs
• entrypoint.mjs

---

_{Reviewed by minimax-m2.5-20260211 · 331,051 tokens}