Add mirror-skills workflow: sync skills/ to agentmail-skills

[SanjithSambath]

Adds .github/workflows/mirror.yml: on every merge to main touching skills/**, rsyncs skill folders to the root of agentmail-skills, turning that repo into a read-only mirror.

Design points:

• Path stability: skills.sh (~5.4K installs) and 9+ third-party skills-lock.json files pin agentmail-to/agentmail-skills with root-level skillPaths — the sync preserves all historical folder names, and a guard step fails the run before pushing if any pinned <skill>/SKILL.md would vanish.
• agentmail-sdk alias: that skill is consolidated into agentmail (PR Release 0.4.0: consolidate agentmail-skills content, add education skills #5), but external lockfiles pin agentmail-sdk/SKILL.md, so each sync re-creates it as a copy of agentmail with the frontmatter name rewritten.
• agents/openai.yaml dirs are stripped from the mirror (plugin-only metadata); README/LICENSE on the mirror are preserved.
• Plain push with history, commit-if-changed (idempotent — verified by dry-run against a local mirror clone, second pass produces zero diff), concurrency group serializes racing merges.
• Auth via a write-scoped deploy key on agentmail-skills, private key as MIRROR_DEPLOY_KEY secret here (to be provisioned before first dispatch; the GITHUB_TOKEN stays contents: read).

Merge order: after PR #5 (otherwise the first sync would delete the education skills from the mirror). Merging this PR fires no sync (path filter) — the first sync is a manual workflow_dispatch after the secret exists.

🤖 Generated with Claude Code

[SanjithSambath]

Closing — direction inverted. agentmail-skills becomes the source of truth and agentmail-plugins becomes an export target, so this workflow syncs the wrong way. The design (rsync + path guard + alias regeneration + idempotency, dry-run tested) will be reused in the opposite direction from the skills repo. See the audit doc for rationale.