fix(meta): 補齊稽核缺失並修掉護欄失效

What：依 jsc-meta:skill-check 的稽核結果修正技能與工具——補上每個步驟的可檢核完成條件、
把留在內文的標準輸入輸出流程下放 tools/、修正查表與退碼路由造成的誤判。

Why：稽核發現這些缺失會讓技能在實際執行時走錯分支或靜默通過。
完成條件缺漏是最常被違反的一項；退碼誤判與查表錯誤則會讓良性狀況被當成失敗。

How：逐項對照 references/guidelines.md 的審核檢查清單修正，新增的工具都有
documented exit codes，並以真實執行驗證每條路徑。

Who：jsc-meta:skill-check 例行稽核（2026-08-25）。

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

skills/skill-new/SKILL.md

@@ -10,18 +10,27 @@ Single source of guidelines: [`../../references/guidelines.md`](../../references
 ## Flow
 
 1. Ask for skill details via the `jsc-ask:ask` decision tree until no doubt remains:
-   - Goal (single and not duplicating an existing skill; first scan `jsc-*/skills/*/SKILL.md` and list similar skills for comparison — options must state the impact scope of "reuse existing" versus "create new")
+   - Goal (single and not duplicating an existing skill; run `tools/list-skills.sh` first and show the similar skills for comparison — options must state the impact scope of "reuse existing" versus "create new")
    - Trigger (when to use, when not to, trigger keywords)
    - Input and output (can a standard input/output flow move down to `tools/`; does it need Gitea operations — if so, make the skill use `jsc-gitea/tools/gitea.sh` + token)
-   - Owning domain (list the existing `jsc-*` domains to choose from)
-2. If the domain does not exist (if the repository exists on Gitea but not in the working directory, clone it and skip to step 3):
-   1. Propose one short English word for the new domain (a single word preferred) and confirm it with the user.
-   2. Ask the user to create the repository `plugins/{domain}`. Clone it, then build the content following the structure of `https://gitea.jsc.idv.tw/plugins/template`: three plugin manifests (plugin name `jsc-{domain}`, version starting at `0.0.1`), `skills/`, README.md, AGENTS.md.
-   3. Add the plugin entry (URL source pointing at the new repository) to `.claude-plugin/marketplace.json` and `.agents/plugins/marketplace.json` in `plugins/meta` (the canonical copy), then sync the two updated files to every domain repository, including the new one. Every repo carries the same marketplace files, so any repo works as the registration entry point. The sync MUST run as a sub agent.
+   - Owning domain (run `tools/sync-domains.sh` and offer its domain list — the domains registered in the canonical marketplace)
+
+   Completion condition: goal, trigger, input/output and owning domain each have a recorded answer.
+2. If the domain does not exist (`tools/sync-domains.sh` clones every domain **registered in the marketplace**, so a missing directory means the domain is unregistered — the repository itself may already exist on Gitea):
+   1. Propose one short English word for the new domain (a single word preferred) and confirm it with the user. Completion condition: the user confirms the domain word.
+   2. Check before creating: run `jsc-gitea/tools/gitea.sh clone-url plugins/{domain}`. A URL comes back when the repository already exists — clone it, skip creation, and go on to step 2.3 to fill in whatever content is missing. Only when no URL comes back create the repository through the tool, never by hand: `gitea.sh api POST /orgs/plugins/repos` when `plugins` is an organization, `POST /user/repos` when `plugins` is the token's own account (`tea repo create` does the same job). Only when the call is refused (403 — the token has write but not admin rights on the owner) ask the user to create `plugins/{domain}` by hand, then continue. Completion condition: `gitea.sh clone-url plugins/{domain}` prints a URL and cloning it succeeds.
+   3. Build the content following the structure of `https://gitea.jsc.idv.tw/plugins/template`: three plugin manifests (plugin name `jsc-{domain}`, version starting at `0.0.1`), `skills/`, README.md, AGENTS.md. Completion condition: the three manifests, `skills/`, README.md and AGENTS.md all exist in the new repo.
+   4. Register the plugin: run `tools/sync-marketplace.sh {domain} {repo-url} {description}`. It needs `python3` on PATH — it edits the marketplace JSON with the json module. It writes the entry into both canonical marketplace files in `plugins/meta` and copies both into every domain repo, so any repo works as the registration entry point. Route each exit code:
+      - Exit 3 — written, but some domain repo is not present locally. Run `tools/sync-domains.sh`, then rerun this step.
+      - Exit 2 — usage error. Fix the three arguments and rerun.
+      - Exit 1 — missing python3, an unreadable canonical file, or a byte mismatch between copies. Read stderr, fix the named cause (install python3 for the first), then rerun.
+      - Exit 0 — every copy holds identical bytes; the script verifies that itself.
+
+      Completion condition: the script exits 0 and prints the touched paths.
 3. Generate the skill per guidelines.md — this step MUST run as a sub agent:
-   - `skills/{name}/SKILL.md`: entirely in English (description ≤ 5 sentences with trigger conditions; body in STE100-style English)
+   - `skills/{name}/SKILL.md`: entirely in English (description within either cap — ≤ 5 sentences or ≤ 5 steps — and stating when to use and when not to; body in STE100-style English)
    - Rules enforceable by hooks go to `jsc-hooks` (never scattered in this domain); standard input/output flows go to `tools/`
 
-   Then run `tools/sync-skill-manifest.sh {domain-path}` directly (no sub agent needed) to sync the domain README's 「Skills 目錄」 section and bump the version in all three manifests.
-4. Self-check every item of the guidelines.md audit checklist; fix anything that fails.
-5. Call `jsc-git:pr` to open a Push Request.
+   Then run `tools/sync-skill-manifest.sh {domain-path}` directly (no sub agent needed) to sync the domain README's 「Skills 目錄」 section and bump the version in all three manifests. Completion condition: `skills/{name}/SKILL.md` exists, the README lists the skill, and all three manifests show the same new version.
+4. Self-check every item of the guidelines.md audit checklist; fix anything that fails. Completion condition: every checklist item passes.
+5. Call `jsc-git:pr` to open a Push Request. Completion condition: a PR URL comes back.