Publish the skills-only plugin root as its own image #97

#91 adds a skills-only plugin root, opt/kagent-tools-skills, to the tools image. A kagent Agent that mounts this root still pulls the whole tools image. In our tests that was 195 MiB compressed and 2.4 to 5.5 seconds to unpack on a cold node, to read 32 KiB of SKILL.md files.

This issue is a follow-up to #91 and does not block it.

Build the skills root from scratch

Build the skills-only root as a second image, ghcr.io/kagent-dev/kagent/tools-skills, from scratch. I tested the change below on the head of #91, cc1e04e:

• The skills image is 82 KiB in one layer and builds in about 3 seconds.
• The skills image has the same skills as opt/kagent-tools-skills in the tools image.
• make docker-build still builds the tools image, and scripts/verify-plugin-image.sh passes on it.

--- a/Dockerfile
+++ b/Dockerfile
@@ ... @@
+FROM scratch AS skills
+COPY --from=plugin /out/opt/kagent-tools-skills /opt/kagent-tools-skills
+
 FROM gcr.io/distroless/static:nonroot
--- a/Makefile
+++ b/Makefile
@@ ... @@
+SKILLS_IMG ?= $(DOCKER_REGISTRY)/$(DOCKER_REPO)/tools-skills:$(TOOLS_IMAGE_TAG)
+docker-build-skills: buildx-create
+	$(DOCKER_BUILDER) build $(DOCKER_BUILD_ARGS) $(TOOLS_IMAGE_BUILD_ARGS) --target skills -t $(SKILLS_IMG) -f Dockerfile ./
--- a/.github/workflows/tag.yaml
+++ b/.github/workflows/tag.yaml
@@ ... @@
         make docker-build
+        make docker-build-skills
--- a/docs/kagent-skills.md
+++ b/docs/kagent-skills.md
@@ ... @@
-        oci: ghcr.io/kagent-dev/kagent/tools@sha256:<digest>
+        oci: ghcr.io/kagent-dev/kagent/tools-skills@sha256:<digest>

Keep the skills stage above the final stage. The last stage is the default build target, so the tools image build does not change.

Files to change

• Dockerfile: add the skills stage.
• Makefile: add the docker-build-skills target.
• .github/workflows/tag.yaml: push the skills image on release.
• docs/kagent-skills.md: point the skills-only example at the skills image.
• Optional: in scripts/verify-plugin-image.sh, check that the skills image has the same skills as the tools image.

Make the package public after the first release

The first release push creates the tools-skills package. If GitHub creates the package as private, a repo admin makes it public once in the package settings. Every other kagent-dev image is public.

After the skills image ships, we will point the example Agents in the kagent chart at it.