docs: add SkillHub/Astron governed publishing guide

[FenjuFu]

Summary

Document a tested path for publishing a reviewed Scientific Agent Skills subset into SkillHub, part of the iFLYTEK Astron ecosystem. The guide pins the upstream checkout, validates each skill with the released CLI before upload, and keeps SkillHub review/governance in the loop.

Type of change

• Documentation

Skills touched

• none

How this was tested

git diff --check
npm view @astron-team/skillhub version
# 0.1.9

npx --yes @astron-team/skillhub@0.1.9 publish --help
# confirmed --namespace, --visibility, --dry-run, --registry, and --token

gh api repos/K-Dense-AI/scientific-agent-skills/contents/skills/{scanpy,rdkit,literature-review}/SKILL.md?ref=v2.64.0
# all three pinned example skills exist

The new SkillHub, Astron topic, and SkillHub #516 links returned HTTP 200. This Windows environment has no bash; the documented loop uses standard POSIX for, [ -d ], and continue syntax.

Related issues and references

• [Feature] Import & sync skills from community skill repos (agent-skills style layouts) iflytek/skillhub#516
• https://github.com/topics/iflytek-astron
• https://github.com/iflytek/skillhub

Checklist

Skill format

• Not applicable: no skill directory or frontmatter changed.

Validation and tests

• Relevant documentation commands and links were checked.
• Not applicable: skill validation/security scanning was not triggered because no skill changed.

Content and safety

• The example starts with a pinned source revision and a reviewed topical subset.
• No real credentials, private data, or unsafe instructions are included.
• Per-skill license/dependency review and registry request limits are called out.

Notes for reviewers

The released SkillHub CLI currently publishes one skill per command, so the guide intentionally uses a transparent loop and does not claim that root plugin.json, collection semantics, provenance sync, or scheduled re-sync are imported. Those broader capabilities remain in SkillHub #516.

[rajpratham1]

Please verify and clarify the SkillHub/Astron publishing instructions before merging. The example registry URL and CLI/version details should be clearly marked as placeholders or replaced with verified values, so users don't accidentally follow the documentation as a production publishing workflow.

[FenjuFu]

Thanks for flagging this. I updated the guide to identify the registry URL and credentials as administrator-provided placeholders, distinguish the server and CLI version lines, and document that the verified npm CLI 0.1.9 does not support publish --dry-run. The invalid dry-run workflow is now replaced with local skills-ref validation, and publication is explicitly marked as state-changing and limited to one approved skill at a time.

Addressed in 5fa3a83.