fix: APM skill.ts — YAML escaping, type safety, and test coverage

[tamirdresher]

Follow-up from PR #876 post-merge review

Reviewer: River (TypeScript Architect) via @diberry
Original PR: #876

Critical

1. No YAML value escaping — skill names/descriptions containing colons, hashes, quotes, or newlines produce invalid YAML in publish() and generateApmYml()
2. Hand-rolled YAML parser in installFromGitHub — line-splitting and regex will break on multi-line strings, quoted values with colons. Consider yaml npm package (0 deps, 50KB).

Medium

3. catch (err: any) x2 should be catch (err: unknown) with narrowing (skill.ts:1057, 1171)
4. as { name: string; path: string } x3 should use type guards (skill.ts:1117, 1125, 1131)
5. Non-null assertions (!) x6 — regex groups and array indices not narrowed by TS
6. parseFrontMatter returns Record<string, string> — no compile-time contract (skill.ts:819)
7. ApmManifest declared but never validated at runtime

Low

8. generateApmYml uses sync fs (writeFileSync) while skill.ts is fully async
9. Silent error swallowing in collectSkills, readProjectName, listSkills
10. 568 lines in one file — needs splitting

Action Items (priority order)

1. Add YAML value escaping for all publish/init output paths
2. Add unit tests for YAML parsing — at least 5 cases
3. Replace catch (err: any) with catch (err: unknown)
4. Add parseApmManifest() runtime validator
5. Consider yaml npm package vs maintaining regex parser

Also noted by @Omzig

• .copilot/skills/ is not supported by GitHub Copilot CLI (only github.com). VS Code enhancement request (Normalize Github Copilot File Locations microsoft/vscode#308091) was closed.

[Omzig]

Assumption?

Maybe .copilot/skills is not supposed to be triggered outside the squad.agent.md agent workflow, i could be wrong in my understanding about the direction that this is going. I am totally ok if this is by design, just didnt want anything to be missed if they are supposed to be triggerable.

More CLI Testing: Insiders Branch

Notice that the Copilot CLI ignores the added vscode locations settings for .copilot/skill:

[Omzig]

Stay safe @tamirdresher, praying for you guys.

[bradygaster]

Resolved by PR #963 — type safety, YAML escaping, and test coverage fixes are all in. Thanks @tamirdresher!