skills: nothing stops a skill's Markdown accumulating an unshipped program — audit is clean today, add the guard

[evanharmon1]

Invariant

A skill's Markdown documents decisions; its assets/ hold the mechanism.
No skill file accumulates a body of fenced shell large enough to be a program
the operator must transcribe before it can run — the failure #420 describes.

Nothing enforces this today, so the only thing standing between the skill tree
and a second mode-update.md is whoever notices.

The audit is already done — and it is clean

Run across all 36 skill Markdown files in ai/skills/, counting fenced
sh/bash/shell/console lines. Every file with 15+ lines:

file	blocks	shell lines	longest block
repo/standardize-repo/references/mode-update.md	31	1,882	1,196
repo/standardize-repo/references/mode-new-repo.md	6	168	59
repo/standardize-repo/references/mode-adopt-existing.md	8	87	39
universal/kickoff/SKILL.md	1	20	20
universal/track-work/SKILL.md	10	22	4

mode-update.md is the only instance. The gap is not marginal — it carries
11× the shell of the next file and a single block 20× the next-longest. The
rest are what fenced shell should be: track-work is 10 blocks averaging 2
lines (one-line gh invocations), kickoff is a single 20-line snippet, and
the other two update-mode siblings top out at a 59-line block.

So this issue is not a request to go looking. The looking is done; #420 is
the finding. What is missing is the guard that keeps it a finding of one.

Why a threshold is safe here

The distribution makes this unusually easy to gate without false positives.
Legitimate maximums today are 168 lines per file and 59 per block; the
violation is 1,882 and 1,196. Anything in between — say 400 per file,
150 per block — has an order of magnitude of headroom over every honest file
while still having caught mode-update.md the day it crossed over.

The check should measure the longest single block as well as the total. A
file of thirty small invocations is healthy; one 1,196-line block is a program
regardless of what the file totals, and total-only would miss it.

Verify

find ai/skills -name '*.md' | while read -r f; do
  awk -v F="$f" '
    /^```(sh|bash|shell|console)$/ { inb=1; c=0; next }
    /^```$/ { if (inb) { t+=c; if (c>max) max=c }; inb=0 }
    inb { c++ }
    END { if (t >= 15) printf "%-52s lines=%-6d longest=%d\n", F, t, max }
  ' "$f"
done

Output means: any file whose lines or longest sits far outside the
table above is a candidate for the same treatment as #420 — the mechanism
belongs in assets/. An empty result, or only the five rows above, means the
tree is still clean.

Acceptance criteria

• A check measures fenced shell per skill Markdown file — both total lines
  and longest single block — and fails above documented thresholds.
• It runs in the repo's own gate rather than on request, alongside the
  existing documentation-mass audit (task audit:agent-instructions /
  scripts/check-agent-instructions-size.sh is the closest precedent, and
  scripts/lint-hygiene.sh the closest host).
• The thresholds are recorded with the reasoning above, so raising one is a
  deliberate act rather than a silent accommodation.
• mode-update.md is either exempted with a pointer to standardize-repo: update mode's guarded recipe ships as prose, not as a runnable asset #420 or the
  check is landed after standardize-repo: update mode's guarded recipe ships as prose, not as a runnable asset #420 resolves — a guard that ships permanently red
  trains everyone to ignore it, which is the failure standardize-repo: verify-applied's unrendered-marker scan false-positives on jinja-named test fixtures #193 documents for
  verify-applied.sh.
• A fixture asserts the check fires: a skill file with an oversized fenced
  block is reported, and a file of many small blocks is not.

Related

• standardize-repo: update mode's guarded recipe ships as prose, not as a runnable asset #420 — the one instance this guard exists to prevent recurring. That issue
  moves the mechanism into assets/; this one stops the next one accumulating.