ci: re-pin zi-install from z-shell/agent-skills (z-shell/.github#741)

[ss-o]

Summary

Re-pins the vendored zi-install skill to its new home in z-shell/agent-skills (z-shell/.github#741, ADR-0037). It follows the re-pin pairing in z-shell/.github runbooks/org-review.md.

• .github/skills/zi-install/: reinstalled with gh skill install z-shell/agent-skills plugins/z-shell/skills/zi-install --pin 01aa715a… --dir .github/skills --force. The body is unchanged. The skill is now user-invoked: disable-model-invocation: true in SKILL.md, plus a new agents/openai.yaml with allow_implicit_invocation: false. Before --force, the local SKILL.md matched the previously approved digest exactly, so nothing local was overwritten.
• .github/workflows/org-routing.yml: the caller moves from a07ed57c to 502ec614, current z-shell/.github main. Its approved record names the agent-skills revision (feat(agents): approve zi-install from agent-skills (#741) .github#759) and keeps code-review at ede9ed98 from ci: re-pin the code-review skill with bundled criteria #232.
• AGENTS.md: routing block regenerated with org-routing.py apply; the entry now reads "skill from z-shell/agent-skills vendored at approved revision 01aa715a124a".
• .trunk/trunk.yaml: the Prettier and markdownlint exclusion now covers .github/skills/zi-install/** as well, so the formatter cannot rewrite the pinned files.
• contracts/installer-contract-v1.json: the external consumer moves from z-shell/.github:.github/skills/zi-install/SKILL.md to z-shell/agent-skills:plugins/z-shell/skills/zi-install/SKILL.md, with published evidence at 01aa715a. The surfaces are unchanged. contract_version goes from 3 to 4, because the detector's policy treats removing a consumer as breaking.
• tests/installer-contract-impact.zsh: the pending-evidence assertion names the new consumer path.

[installer-impact:z-shell/.github:.github/skills/zi-install/SKILL.md] updated here: the skill moved to z-shell/agent-skills; its new consumer entry is added in this PR

Refs z-shell/.github#741.

Verification

• org-routing.py check --repository z-shell/src with z-shell/.github tooling at 502ec614: current.
• installer-contract-impact.zsh --base origin/main --head HEAD with this PR body: exit 0. It reports consumer-removal (breaking, acknowledged) and consumer-addition (informational).
• tests/installer-contract-impact.zsh: 7 ok. sh ./tests/installers.sh: pass. trunk check: no issues.
• installer-contract-evidence.zsh: the agent-skills consumer is current. The audit still exits 1 for z-shell/zi/README.md, whose pin was already stale on main. That push-only audit fails on main today for both that pin and the old z-shell/.github one, and this PR clears the latter.

Agent handoff

• Status: Ready for review
• Next steps: remove .github/skills/zi-install from z-shell/.github; refresh the stale z-shell/zi/README.md evidence pin as a separate change.
• Related tracker/issues: Publish user and developer agent skills from a dedicated z-shell/agent-skills repository .github#741

[cloudflare-workers-and-pages]

Deploying src with    Cloudflare Pages

Latest commit:	045ab7a
Status:	✅  Deploy successful!
Preview URL:	https://c3570e2c.zi-src.pages.dev
Branch Preview URL:	https://feature-741-repin-skills.zi-src.pages.dev

View logs

[ss-o]

Fallback review under ADR-0026: Copilot request not registered on 045ab7a

Findings

No actionable findings.

Scope: The complete diff against main (9bc3476): the reinstalled zi-install skill and its agents/openai.yaml, the Org Routing caller pin, the regenerated routing block, the Trunk exclusion, the installer contract entry and version, and one test assertion.

Note

This is a maintainer-elected self-review, not an independent review or approval to merge.

Validation

• Passed: all 15 checks on this head, including Org Routing / Org Routing at 502ec614 and Installer contract impact with the acknowledgement marker. Installer consumer evidence is skipped on pull requests by design.
• Local: org-routing.py check current; the impact detector exits 0 with this body; detector tests 7 ok; tests/installers.sh passes; trunk clean.
• Known pre-existing failure: the push-only evidence audit still reports z-shell/zi/README.md as stale, as it already does on main. This change clears the other stale pin it reports there.

Checklist verdicts and supporting evidence

• Re-pin pairing: pass. Skill reinstall, caller pin and routing block move together, as runbooks/org-review.md requires; the previous local SKILL.md matched the old approved digest before --force.
• Contract: pass. Only the consumer's repository, path and evidence change; its scope and surfaces are identical, and the version bump is what the detector's breaking-gate policy requires for a consumer removal.
• Formatter safety: pass. .github/skills/zi-install/** joins the existing Prettier and markdownlint exclusion, so the pre-commit formatter cannot change the pinned bytes.