feat: runtime smoke test, gitea actions workflows, runtime-checks record

AGENTS.md

@@ -53,12 +53,17 @@ safe intermediate work.
   `ctx.agent.transform(editor)` **cannot add** agents — only list/get/update/remove/default. Hence:
   skills ship via plugin injection, agents via `init` copy.
 - `Agent.Info` (verified): `{ id, name, mode: subagent|primary|all, description?, model?, system?,
-  hidden, color?, steps?, request{settings,headers,body}, permissions[{action,resource,effect}] }`.
+hidden, color?, steps?, request{settings,headers,body}, permissions[{action,resource,effect}] }`.
 - Skills frontmatter honored: `name`, `description`, `slash`, `disable-model-invocation` /
   `metadata.opencode/autoinvoke` (hidden from model, still loadable by id/slash).
 - Agent files: `.opencode/agents/<name>.md` (project), `~/.config/opencode/agents/` (global);
   frontmatter = agent config, body = system prompt.
 - Permission rules are ordered, last match wins; per-agent skill restrictions via
-  `{action: "skill", resource: "<pattern>", effect: ...}`. Shell action is `shell` in V2.
+  `{action: "skill", resource: "<pattern>", effect: ...}`. V2 actions include `shell`, `edit`,
+  `read`/`glob`/`grep`, `webfetch`, `skill`, `subagent`, `external_directory`; no rule → ask.
+- Runtime-verified on v2.0.29 (see docs/runtime-checks.md): local plugin entries must be
+  DIRECTORIES (file entries ignored); `/api/skill` omits `autoinvoke` when true; injected skills
+  get no slash commands (file-based only); default rules already allow `external_directory /tmp/*`;
+  injected content must have frontmatter stripped; serve prints its Basic-auth password.
 - Agent `steps` replaces `maxSteps`; `temperature`/`top_p` go under `request.body` (not yet sent by
   the runner — avoid).