Add Skill-to-Loop upgrade workflow

[Conradgui]

Summary

• add a Skill-to-Loop route for assessing an existing Agent Skill before changing it
• return a structured decision record with stable findings, Loop boundaries, preservation rules,
  and a validation plan
• support four Skill-preserving outcomes: keep the Skill non-looping, embed bounded Loops, make the
  Skill loop-first, or split independent feedback cycles behind a parent Skill
• require specific approval before an Upgrade edits the target, then validate both the complete
  Skill package and each introduced Loop

Why

Loopy already helps users discover, craft, audit, run, and publish Loops, but many users start with
an existing Agent Skill rather than a standalone Loop idea. Repeating or compressing the Skill is
not enough: Loopy first needs to determine whether feedback actually changes later actions and
where a bounded Loop belongs without losing the Skill's discoverable wrapper.

This workflow makes that architectural decision explicit and auditable. Assessment is read-only by
default, a generic request to "upgrade this Skill" does not grant edit authority, and an approved
Upgrade preserves the complete Agent Skill as the primary artifact.

What changed

• added references/upgrade-skill.md to canonical Loopy and its compatibility alias
• added the Skill-to-Loop route, authority boundary, and lifecycle handoffs to both Skill entry
  points
• updated Codex-facing metadata so explicit and implicit requests can discover the new route
• documented the new capability and its compact-prompt boundary in the README and changelog
• extended repository contract checks to protect the Decision Record, architecture rules,
  canonical/alias parity, linked audit workflow, and metadata behavior

Safety and compatibility

• existing non-Skill Discover, Craft, Audit, Run, Debrief, Save, and Publish behavior remains in
  place
• target Skill content is treated as untrusted evidence and cannot expand Loopy's authority
• Assessment does not execute target-provided validators or follow out-of-root paths without
  separate authorization
• compact Loop Library prompts remain optional derivatives of independently reusable Loops; the
  workflow never replaces an upgraded Skill with a prompt

Validation

• node --check loop-library/site/script.js
• node loop-library/scripts/check.mjs
• npm --prefix loop-library/worker run check — 52/52 tests passed
• both canonical and compatibility Skill packages pass the Codex Skill structural validator
• all three repository JSON documents pass python3 -m json.tool
• canonical and compatibility upgrade-skill.md files are byte-identical
• git diff --check

Fresh-context behavior checks also covered the four architecture outcomes, fixed-checklist and
multi-Loop boundaries, explicit legacy-alias routing, Craft versus Skill-to-Loop selection, and the
rule that Upgrade intent does not itself grant mutation authority.

Non-goals

This PR does not introduce a Loop IR, compiler, runtime adapter, scheduler, hook system, automatic
publication, or a new installation mechanism. Those are broader design questions and are
intentionally outside this first contribution.