boost-skills-routes: Skills marketplace route improvements and runtime config (issue 16 after 15)

[gabemontero]

Summary

Refactor the skills marketplace routes introduced in #3311 to read runtimes from local app-config, resolve runtimeId server-side in the deploy endpoint, extract manifest generation into a testable module, and add comprehensive proxy and unit test coverage.

Tasks

From openspec/changes/pluggable-ai-platform-architecture/tasks.md section 8:

• 8a.3 Add proxy tests for GET /skills and GET /skills/domains (mock fetch, verify URL construction, query param forwarding, feature gate, permission checks, non-JSON handling)
• 8b.1 Add boost.skillsMarketplace.runtimes[] Zod schema to schemas.ts (yaml-only scope) with fields: id, name, description, image, language, footprint, features[], status
• 8b.2 Refactor GET /skills/runtimes to read from local app-config instead of proxying to external catalog
• 8b.3 Add tests for GET /skills/runtimes (reads config, returns runtime list, feature gate)
• 8c.1 Change POST /skills/deploy request body to accept runtimeId instead of ociImage; resolve container image from boost.skillsMarketplace.runtimes[] config
• 8c.2 Extract manifest generation into src/skills/manifestBuilder.ts
• 8c.3 Update deploy tests for runtimeId resolution and manifestBuilder unit tests

Additional improvements identified during review

• Add boostAdminPermission fallback to requireAccess middleware (match pattern in chat/routes.ts, mcp/routes.ts)
• Add AbortSignal.timeout() to proxyToSkillsCatalog fetch calls
• Validate skillId/name against K8s RFC 1123 naming rules in deploy endpoint
• Accept separate resources.requests and resources.limits in deploy request body
• Inject RuntimeConfigResolver into skills routes (match pattern used by other route modules)

Specifications

• openspec/changes/pluggable-ai-platform-architecture/tasks.md — Section 8 (Skills Marketplace Integration)
• openspec/changes/agent-creation-discovery/design.md — Decision 6 (skills marketplace consumer)

Context

Depends on #3311 (merged). The openspec section 8 documents design decisions from a grill-me review session:

• Runtimes are local app-config, not proxied from the external catalog
• Deploy endpoint accepts runtimeId in the request body; the backend resolves the container image from config server-side
• Manifest generation is extracted into src/skills/manifestBuilder.ts for independent testability

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 2:17 AM UTC · Completed 2:32 AM UTC
Commit: d196266 · View workflow run →

[fullsend-ai-coder]

An open PR already addresses this issue — skipping automated implementation.

• chore(boost): add issue #3597 to staged-issues.md #3598 by @gabemontero

To override, comment /fs-code --force on this issue.

_{Posted by fullsend pre-code check}