docs(agents): add internal meta-issue-creation and meta-pr-creation skills

[coderdan]

Summary

Agents working on this repo now file issues and open PRs regularly, with no documented structure — quality has depended on the session. This adds two internal skills setting the conventions: a required issue shape (Background / Problem / Proposal) written for a reader who is new to CipherStash, and the branch/commit/PR authoring rules (signed commits, the changeset checklist, PR body sections).

They live in .claude/skills/, not skills/ — everything under skills/ ships to customers inside the stash npm tarball (packages/cli/tsup.config.ts copies the whole directory), and these are internal-only. The meta- prefix marks them as repo-process skills, distinct from the customer-facing stash-* set.

Changes

• .claude/skills/meta-issue-creation/SKILL.md — pre-filing checks (search existing issues open and closed, verify claims against code, pick the right repo), the required section structure, dumbed-down wording rules, cross-linking in both directions.
• .claude/skills/meta-pr-creation/SKILL.md — branch/commit conventions, signed-commit verification (%G?) and the re-sign rebase recipe, the AGENTS.md pre-PR checklist by pointer, PR body structure, force-push etiquette.

Both encode two reference traps from recent sessions: bare #N autolinks to an unrelated issue unless a GitHub reference is intended, and internal Linear (CIP-) numbers must never appear on GitHub.

Verification

Docs-only; no build or tests apply. Checked that .claude/skills/ is outside every tarball copy path (tsup.config.ts copies skills/ and doctrine/ only). No changeset: .claude/ is internal and ships nowhere, per the changeset rule these skills themselves document.

Related

Conventions distilled from the sessions around #895/#897 (skill corrections), #896 (hazard comments), and #918 (issue filing).

[changeset-bot]

⚠️ No Changeset found

Latest commit: c87e7eb

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[freshtonic]

Approve. Right content, right location, and the one claim that matters for a "these must not ship" PR checks out: I verified packages/cli/tsup.config.ts copies only skills/ (→ dist/skills) and src/commands/init/doctrine (→ dist/doctrine) — nothing touches .claude/, so these two files stay internal. The meta- prefix cleanly separates repo-process skills from the customer-facing stash-* set.

Content spot-checks against the rules these skills encode:

• The changeset guidance matches AGENTS.md exactly, including the two subtle cases that actually trip people: a skills/-only change needs a stash patch changeset (tarball-shipped), a .claude/-only change doesn't — and this PR correctly practices the second rule on itself.
• The signed-commit recipe (%G? check, rebase --force-rebase + --force-with-lease) matches how this repo actually operates, and pointing at AGENTS.md § "Adding Features Safely" as the authoritative checklist rather than restating it is the right durability call — the skill can't drift from a list it doesn't duplicate.
• The two reference traps are real and worth encoding: bare #N autolinking to an unrelated issue has bitten these sessions, and the Linear (CIP-) exclusion is a genuine public/private boundary, correctly stated as absolute.
• The issue-shape guidance ("a closed issue is a finding, not a dead end", verified-vs-plausible separation, symptom-first titles) distills what has observably made the recent agent-filed issues in this repo good ones.

Two non-blocking observations:

• The draft-first rule in meta-pr-creation ("always open as a draft, mark ready only when the user says so") is a policy choice worth having written down precisely because nothing enforces it — same category as the rest of the file, fine.
• These skills are only read by agents whose session loads .claude/skills/ — Codex sessions on this repo won't see them. Not worth solving now (mirroring into .codex/skills/ would create a sync burden), just worth knowing the coverage boundary exists.