ci(portal): fix coverage path (fast-check + denominator), bump testTimeout, add skills symlink

Portal test-infra fixes exposed by the invariant-first refactor (#6); the S1
timeout itself is fixed separately by #19, so this no longer touches
portal-shell.test.ts.

- scripts/sync-upstream.sh: the --coverage branch never provisioned fast-check
  (only --test did), so the 5 property-test files failed with "Failed to load
  url fast-check" — the coverage path is broken on main today. Extract a shared
  provision_fastcheck() called by both branches; in --coverage AFTER `pnpm add`
  (which re-resolves node_modules and would prune the manually-copied tree).
- vite.portal.config.ts: coverage `include` was a stale hand-list of 5 files;
  the refactor's 10 new portal-*.ts modules were silently dropped from the
  denominator. Switch to a glob matching the copy step (portal*.ts + realtime*.ts)
  with exclude ['**/*.test.ts'].
- vite.portal.config.ts: bump testTimeout 15000 -> 30000 as general headroom for
  the real-backoff head-probe tests + coverage instrumentation on a loaded CI box.
- .claude/skills -> .agents/skills: a single directory-level symlink so any skill
  added under the tracked .agents/skills/ is picked up automatically (force-added
  past the .claude/ gitignore).

Verified: --test 140/140; --coverage 140/140 (fast-check provisioned, 94.86%
stmts / 85.11% branches / 95.89% funcs on the full glob denominator).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: mo4islona

.claude/skills

@@ -0,0 +1 @@
+../.agents/skills

portal/vite.portal.config.ts

@@ -14,21 +14,24 @@ export default defineConfig({
       'src/sync-historical/portal*.test.ts',
       'src/sync-historical/realtime*.test.ts',
     ],
-    testTimeout: 15000,
+    // 30s (not 15s): portal-shell's heavy fake-timer/retry tests run ~15s under coverage
+    // instrumentation, which flakes on a loaded CI server. Give per-test headroom.
+    testTimeout: 30000,
     // Coverage is scoped to the Portal layer (the whole diff vs upstream ponder). Inert on a plain
     // `--test` run: it only activates under `--coverage` (see scripts/sync-upstream.sh --coverage),
     // so the normal path needs no coverage provider installed.
     coverage: {
       provider: 'v8',
       reporter: ['json-summary', 'text-summary'],
       reportsDirectory: 'portal-coverage',
+      // Match the copy step's GLOB (scripts/sync-upstream.sh: portal*.ts + realtime*.ts) so a
+      // newly added Portal module is never silently dropped from the coverage denominator.
+      // Tests are excluded so they don't inflate the numbers.
       include: [
-        'src/sync-historical/portal.ts',
-        'src/sync-historical/portal-transform.ts',
-        'src/sync-historical/portal-realtime.ts',
-        'src/sync-historical/portal-realtime-wire.ts',
-        'src/sync-historical/realtime.ts',
+        'src/sync-historical/portal*.ts',
+        'src/sync-historical/realtime*.ts',
       ],
+      exclude: ['**/*.test.ts'],
     },
   },
 });

scripts/sync-upstream.sh

@@ -64,18 +64,24 @@ let n=0; for(const s of ['dependencies','devDependencies','peerDependencies']){
 fs.writeFileSync(pkgPath, JSON.stringify(pkg,null,2)+'\n'); console.log('  rewrote '+n+' workspace dep(s)');
 "
 
-if [ "${2:-}" = "--test" ]; then
-  # `fast-check` (property tests) is a DEV-ONLY dep of the clone — never a runtime dep of the published
-  # package. We provision it straight into the core's node_modules rather than adding it to package.json,
-  # because renaming the core to @subsquid/ponder orphans sibling workspace packages (e.g. benchmark's
-  # `ponder@workspace:*`), so a lockfile re-resolve (which a new package.json dep would force) fails.
+# `fast-check` (property tests) is a DEV-ONLY dep of the clone — never a runtime dep of the published
+# package. We provision it straight into the core's node_modules rather than adding it to package.json,
+# because renaming the core to @subsquid/ponder orphans sibling workspace packages (e.g. benchmark's
+# `ponder@workspace:*`), so a lockfile re-resolve (which a new package.json dep would force) fails.
+# Both --test and --coverage need it (the property tests import fast-check), so it's a shared step.
+provision_fastcheck() {
   echo "▶ provisioning fast-check (dev-only, for the property tests)"
   # OUTSIDE the clone so npm doesn't walk up into the pnpm workspace root. Pinned exactly for
   # reproducible CI; the whole resolved tree is copied so transitive deps can never be missed.
+  local FCDIR
   FCDIR="$(mktemp -d)"
   ( cd "$FCDIR" && npm init -y >/dev/null 2>&1 && npm install --no-audit --no-fund --silent fast-check@3.23.2 )
   cp -R "$FCDIR/node_modules/." "$CORE/node_modules/"
   rm -rf "$FCDIR"
+}
+
+if [ "${2:-}" = "--test" ]; then
+  provision_fastcheck
   echo "▶ running Portal-layer tests"
   ( cd "$CORE" && pnpm exec vitest run --config vite.portal.config.ts )
 fi
@@ -91,6 +97,9 @@ if [ "${2:-}" = "--coverage" ]; then
   echo "▶ installing @vitest/coverage-v8@$VITEST_VER (matching installed vitest)"
   ( cd "$CORE" && $PNPM add -D "@vitest/coverage-v8@$VITEST_VER" --ignore-workspace )
 
+  # AFTER `pnpm add` — it re-resolves node_modules and would prune the manually-copied tree.
+  provision_fastcheck
+
   echo "▶ running Portal-layer tests with coverage"
   ( cd "$CORE" && pnpm exec vitest run --config vite.portal.config.ts --coverage )
   echo "✓ coverage summary → $CORE/portal-coverage/coverage-summary.json"